MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3
SHA3-384 hash: 731b60afe852b598f6375ef6cd7dafe0440a37bf42dfc9aa103b0cfbfc93db42dc34c5e56e50a88818818a3a31eb7908
SHA1 hash: 049094a6d7fb9c74b849ef77098b1c0843bf7ee3
MD5 hash: cd8cbf45ad32e1be22c9306b5d18fa1f
humanhash: mars-apart-snake-echo
File name:amd64
Download: download sample
File size:482'032 bytes
First seen:2025-07-13 05:14:51 UTC
Last seen:2025-07-14 01:27:32 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH T15BA41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
16
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9080.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687340e1900df8e7f86a541blinux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creates directories
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
exploit gcc lolbin packed remote
Link:
https://www.filescan.io/uploads/687340e5a15b22faa8affc7a/reports/b4e15d91-6b2e-41ae-a30b-7890b80b946a/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
70
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 70.112.89.86:6881
type: 89.179.246.14:6881
type: 87.197.188.206:6881
type: 193.233.182.44:6881
type: 81.42.195.81:6881
type: 31.135.107.212:6881
type: 176.110.250.22:6881
type: 87.115.219.118:6881
type: 80.227.77.239:6881
type: 119.231.224.235:6881
type: 142.114.18.19:6881
type: 202.153.216.40:6881
type: 114.253.243.135:6881
type: 66.119.99.5:6881
type: 95.56.51.64:6881
type: 220.137.186.113:6881
type: 178.25.198.49:6881
type: 189.140.133.133:6881
type: 213.112.241.176:6881
type: 72.189.65.230:6881
type: 2.86.48.248:6881
type: 54.214.105.212:6881
type: 187.251.215.190:6881
type: 142.171.125.191:6881
type: 31.24.94.67:6881
type: 5.158.110.128:6881
type: 52.9.197.152:6881
type: 110.37.38.171:6881
type: 95.52.117.149:6881
type: 41.135.93.132:6881
type: 135.19.153.132:6881
type: 37.191.63.125:6881
type: 115.50.156.34:6881
type: 192.227.221.84:6881
type: 54.214.62.55:6881
type: 18.188.31.0:6881
type: 54.194.137.170:6881
type: 78.189.229.52:6881
type: 79.119.59.141:6881
type: 84.247.141.118:6881
type: 204.12.208.37:6881
type: 18.223.137.220:6881
type: 194.223.191.249:6881
type: 130.239.18.158:8516
type: 69.164.203.179:6880
type: 52.15.134.118:6880
type: 195.154.233.74:6880
type: 45.203.206.54:6880
type: 3.130.60.88:6880
type: 54.144.88.168:6880
type: 185.196.61.129:6880
type: 18.188.239.31:6880
type: 154.202.133.136:6880
type: 148.153.188.226:6880
type: 45.203.152.94:6880
type: 195.137.220.189:6880
type: 3.228.205.146:6880
type: 52.70.34.253:6880
type: 130.239.18.158:8580
type: 158.69.27.241:43789
type: 178.162.173.91:28003
type: 178.162.173.74:28003
type: 178.162.173.32:28003
type: 89.149.202.3:28003
type: 178.162.173.157:28003
type: 178.162.173.166:28000
type: 178.162.174.183:28000
type: 193.23.250.51:55935
type: 185.149.91.147:51112
type: 178.162.174.149:28001
type: 178.162.173.202:28001
type: 178.162.174.170:28001
type: 178.162.173.169:28001
type: 178.162.174.178:28001
type: 178.162.174.1:28007
type: 212.7.202.40:28030
type: 130.239.18.158:8524
type: 178.57.99.41:51413
type: 86.131.195.234:51413
type: 172.104.193.147:51413
type: 192.99.4.139:51413
type: 80.253.93.152:51413
type: 222.0.129.136:51413
type: 81.171.3.160:51413
type: 5.35.114.10:51413
type: 195.154.222.93:51413
type: 151.80.32.82:51413
type: 198.100.145.91:51413
type: 188.165.216.84:51413
type: 138.68.229.71:51413
type: 45.76.51.24:51413
type: 174.28.6.55:51413
type: 67.188.215.80:51413
type: 75.240.191.114:51413
type: 178.64.27.153:51413
type: 109.130.174.62:51413
type: 115.212.205.227:51413
type: 95.211.81.107:51413
type: 60.152.247.136:51413
type: 66.49.220.61:51413
type: 37.187.115.135:51413
type: 80.209.226.248:51413
type: 153.228.207.157:51413
type: 146.185.175.41:51413
type: 37.187.16.81:51413
type: 178.162.174.168:28012
type: 178.162.174.228:28012
type: 37.48.108.37:28012
type: 178.162.174.9:28012
type: 172.111.38.128:26045
type: 89.67.26.253:58904
type: 65.21.141.87:27602
type: 141.94.246.201:8647
type: 72.21.17.1:20023
type: 116.14.104.14:15601
type: 62.210.76.120:54827
type: 91.199.227.104:16860
type: 185.23.183.131:60020
type: 101.34.92.34:60020
type: 95.216.13.19:50000
type: 144.76.5.155:50000
type: 65.21.32.43:50000
type: 65.21.34.43:50000
type: 65.21.125.170:50000
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 65.21.129.49:50000
type: 65.21.128.240:50000
type: 65.21.125.186:50000
type: 37.27.103.248:50000
type: 65.21.128.214:50000
type: 162.156.28.125:50000
type: 178.162.173.156:28005
type: 178.162.174.228:28005
type: 185.149.91.15:51029
type: 178.162.174.184:28015
type: 62.112.10.81:6885
type: 46.232.210.47:64039
type: 178.162.174.229:28014
type: 178.162.174.222:28014
type: 178.162.174.88:28014
type: 178.162.173.148:28014
type: 178.162.174.224:28014
type: 178.162.174.33:28014
type: 42.112.20.235:8083
type: 159.223.162.113:8083
type: 5.135.156.163:56843
type: 185.149.91.21:51118
type: 130.239.18.158:8520
type: 159.203.67.164:8000
type: 178.162.144.51:21183
type: 130.239.18.158:8510
type: 178.162.174.43:28004
type: 178.162.173.149:28004
type: 130.239.18.158:8515
type: 142.129.95.69:60174
type: 45.91.210.25:52278
type: 79.127.146.183:35750
type: 95.211.198.95:28010
type: 178.162.174.181:28010
type: 178.162.173.12:28010
type: 178.162.173.141:28010
type: 81.171.7.65:28010
type: 178.162.173.16:28010
type: 197.94.212.18:23225
type: 46.232.211.180:51539
type: 45.87.250.224:50171
type: 178.162.174.45:28002
type: 95.211.160.117:28002
type: 178.162.173.74:28011
type: 37.48.118.82:28011
type: 178.162.174.6:28008
type: 185.149.91.159:51025
type: 51.195.220.36:8648
type: 95.217.59.70:8999
type: 130.239.18.158:8526
type: 62.212.81.233:28009
type: 130.239.18.158:8597
type: 130.239.18.158:8513
type: 185.107.44.27:49001
type: 87.103.252.169:49001
type: 188.254.55.154:49001
type: 5.79.112.212:54427
type: 136.243.173.12:52573
type: 84.247.105.246:31761
type: 89.149.202.17:28018
type: 89.38.98.212:6889
type: 1.158.175.126:6889
type: 47.34.174.48:6889
type: 45.87.251.149:28119
type: 176.78.42.111:51111
type: 195.154.176.26:8684
type: 89.134.22.173:10409
type: 72.203.103.181:41659
type: 112.214.4.136:40860
type: 62.192.173.226:52012
type: 188.165.241.169:59014
type: 210.113.127.25:40781
type: 84.52.230.164:49153
type: 175.182.172.125:24792
type: 5.161.92.253:3334
type: 45.155.90.140:8080
type: 162.19.102.3:8080
type: 178.162.174.117:28013
type: 94.158.40.143:2602
type: 14.51.14.243:8041
type: 45.87.251.178:2268
type: 122.150.164.103:65166
type: 84.73.238.141:63218
type: 184.163.96.124:35314
type: 72.194.103.57:43356
type: 89.143.169.197:57731
type: 1.220.160.10:7840
type: 109.153.252.30:19109
type: 81.171.6.81:17417
type: 97.96.251.223:50321
type: 185.149.91.149:51570
type: 45.87.251.165:64042
type: 45.232.185.184:37626
type: 199.195.149.217:23908
type: 49.215.47.100:30773
type: 141.8.205.125:57291
type: 65.108.143.34:56480
type: 221.165.105.80:32778
type: 47.89.251.173:7777
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 54.209.131.199:6992
type: 54.77.218.23:6992
type: 119.206.79.94:41016
type: 45.164.96.202:15030
type: 37.6.236.231:25771
type: 189.6.236.231:16796
type: 95.217.33.172:55183
type: 27.123.173.197:61952
type: 201.123.254.201:42939
type: 183.83.167.11:35296
type: 195.114.156.34:27014
type: 38.134.41.130:32681
type: 23.95.11.50:65524
type: 54.39.52.64:48853
type: 140.186.199.184:9010
type: 103.177.27.83:12879
type: 154.38.161.205:15656
type: 195.154.167.39:8678
type: 195.154.170.6:8657
type: 154.38.118.252:13574
type: 121.173.16.1:41059
type: 211.53.6.39:33049
type: 61.82.57.31:40597
type: 185.21.217.44:50843
type: 46.232.210.120:17309
type: 54.77.218.23:6892
type: 169.224.125.200:60718
type: 83.149.98.181:28006
type: 39.48.170.48:38056
type: 72.21.17.87:10592
type: 45.87.251.149:28118
type: 180.177.1.223:3357
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a27d9fc1-82ff-474c-b95f-439c0ab0a6f1
Behavior Graph:
Download SVG
%3 guuid=b35bec83-1900-0000-4c65-8a0a57090000 pid=2391 /usr/bin/sudo guuid=444d7986-1900-0000-4c65-8a0a5b090000 pid=2395 /tmp/sample.bin guuid=b35bec83-1900-0000-4c65-8a0a57090000 pid=2391->guuid=444d7986-1900-0000-4c65-8a0a5b090000 pid=2395 execve guuid=59dfba86-1900-0000-4c65-8a0a5c090000 pid=2396 /usr/bin/dash guuid=444d7986-1900-0000-4c65-8a0a5b090000 pid=2395->guuid=59dfba86-1900-0000-4c65-8a0a5c090000 pid=2396 execve guuid=16396887-1900-0000-4c65-8a0a5d090000 pid=2397 /usr/bin/dash guuid=444d7986-1900-0000-4c65-8a0a5b090000 pid=2395->guuid=16396887-1900-0000-4c65-8a0a5d090000 pid=2397 execve guuid=634df187-1900-0000-4c65-8a0a61090000 pid=2401 /tmp/sample.bin mprotect-exec zombie guuid=444d7986-1900-0000-4c65-8a0a5b090000 pid=2395->guuid=634df187-1900-0000-4c65-8a0a61090000 pid=2401 clone guuid=80ef9887-1900-0000-4c65-8a0a5f090000 pid=2399 /usr/bin/dash guuid=16396887-1900-0000-4c65-8a0a5d090000 pid=2397->guuid=80ef9887-1900-0000-4c65-8a0a5f090000 pid=2399 clone guuid=cda1a487-1900-0000-4c65-8a0a60090000 pid=2400 /usr/bin/dash guuid=16396887-1900-0000-4c65-8a0a5d090000 pid=2397->guuid=cda1a487-1900-0000-4c65-8a0a60090000 pid=2400 clone guuid=94b0008c-1900-0000-4c65-8a0a6d090000 pid=2413 /tmp/sample.bin zombie guuid=634df187-1900-0000-4c65-8a0a61090000 pid=2401->guuid=94b0008c-1900-0000-4c65-8a0a6d090000 pid=2413 clone guuid=a0e70a8c-1900-0000-4c65-8a0a6e090000 pid=2414 /tmp/sample.bin guuid=94b0008c-1900-0000-4c65-8a0a6d090000 pid=2413->guuid=a0e70a8c-1900-0000-4c65-8a0a6e090000 pid=2414 clone guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415 /tmp/sample.bin dns net net-scan send-data guuid=a0e70a8c-1900-0000-4c65-8a0a6e090000 pid=2414->guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415 clone d316b2ae-0a7e-5b43-8de6-745900c90c54 127.0.0.1:65535 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->d316b2ae-0a7e-5b43-8de6-745900c90c54 con 38a4910e-6f05-5afe-a8e3-398c2eb18329 time.cloudflare.com:123 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->38a4910e-6f05-5afe-a8e3-398c2eb18329 send: 48B 5bc4bf85-96ee-588f-ab8c-cf67dd1b2b15 209.38.196.30:6818 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->5bc4bf85-96ee-588f-ab8c-cf67dd1b2b15 send: 68B 3fb17cec-82df-5ed9-be13-6a5ad34ca48e 31.200.249.178:31773 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->3fb17cec-82df-5ed9-be13-6a5ad34ca48e send: 68B 33f04ae9-c655-57aa-8540-500e9a4ff979 31.200.249.227:31973 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->33f04ae9-c655-57aa-8540-500e9a4ff979 send: 68B 432f8184-be06-5a9c-a2ca-14ea69242dec 31.200.249.146:31972 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->432f8184-be06-5a9c-a2ca-14ea69242dec send: 68B 284b5f64-b865-5421-847c-e67680e13624 31.200.249.178:31971 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->284b5f64-b865-5421-847c-e67680e13624 send: 68B 832fc9f7-b8d0-5460-beb6-e00a786a2ae2 31.200.249.162:31970 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->832fc9f7-b8d0-5460-beb6-e00a786a2ae2 send: 68B 12451eb8-62b9-502a-bc9e-eb876e7a1cfe 54.193.33.181:6881 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->12451eb8-62b9-502a-bc9e-eb876e7a1cfe send: 104B 62bef11e-6d42-5bb9-be2f-0d9ccd668317 54.215.207.56:8305 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->62bef11e-6d42-5bb9-be2f-0d9ccd668317 con dd085fdd-4815-5018-bd66-a274b994c9e9 195.154.182.247:31836 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->dd085fdd-4815-5018-bd66-a274b994c9e9 send: 68B 2821ed42-1861-538f-a37a-18b0a59cba58 209.38.196.30:6816 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->2821ed42-1861-538f-a37a-18b0a59cba58 send: 104B 473063f5-cc60-5216-98ff-ea579331c078 209.38.196.30:6813 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->473063f5-cc60-5216-98ff-ea579331c078 send: 68B f58971e1-c25a-5266-b420-718501f3f010 159.65.200.220:6812 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->f58971e1-c25a-5266-b420-718501f3f010 con 6dfebee2-e48f-5ec3-b15e-47c66ad1063f 116.203.102.228:6812 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->6dfebee2-e48f-5ec3-b15e-47c66ad1063f send: 68B 556e619b-86a3-52f3-83c3-f7dea5d8aabb 54.215.207.56:28960 guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->556e619b-86a3-52f3-83c3-f7dea5d8aabb con guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415|send-data send-data to 283 IP addresses review logs to see them all guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415->guuid=495e128c-1900-0000-4c65-8a0a6f090000 pid=2415|send-data send
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0d843449-199b-459b-a1d6-058d25c79bd9
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1735086
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1735086 Sample: amd64.elf Startdate: 13/07/2025 Architecture: LINUX Score: 68 38 62.182.86.86, 41702 YANINA-ASUA Ukraine 2->38 40 138.255.219.189, 60430 WifiPointProvedordeInternetBandaLargaMELTDBR Brazil 2->40 42 102 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Connects to many ports of the same IP (likely port scanning) 2->46 10 amd64.elf 2->10         started        signatures3 process4 process5 12 amd64.elf sh 10->12         started        14 amd64.elf 10->14         started        17 amd64.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        54 Opens /sys/class/net/* files useful for querying network interface information 14->54 56 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->56 25 amd64.elf 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.OBBtch, ASCII 19->36 dropped 48 Sample tries to persist itself using cron 19->48 50 Executes the "crontab" command typically for achieving persistence 19->50 29 sh crontab 23->29         started        32 amd64.elf 25->32         started        signatures9 process10 signatures11 52 Executes the "crontab" command typically for achieving persistence 29->52 34 amd64.elf 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-07-13 05:15:16 UTC
File Type:
ELF64 Little (Exe)
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5fqgdm3u3bzqle4f6bb5hevbqixhcftprkhzrrdzuc4uferl3bq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/250713-fxnzvaykt3/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4f7b3f1e-2672-46d9-aed1-814779271fa5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:enterpriseunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise UNIX
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf a74b030d9ba6c3982c9c2f821e9c950c117388b37c547cc623cd05ca14915ec3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3550042/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments