MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf
SHA3-384 hash:	1f0eed7a96c79194ff8ba10fb3d296de02611667b0fd94f5ab749592028df3c79fca1615ef674659e82740ddfd030626
SHA1 hash:	8d4869df5df1a9a88e0d0a9d838c71f5e7aba939
MD5 hash:	1a5edcf40f9d95c0c8fddc501ebd9f8c
humanhash:	yankee-high-seven-oregon
File name:	Linux_amd64
Download:	download sample
Signature	GoBrut Alert Create hunting rule
File size:	2'377'240 bytes
First seen:	2022-05-03 01:43:30 UTC
Last seen:	2025-09-08 21:25:29 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	49152:5k3aKkGa7HCrJd+Th/MGkputLSNarbhnRquxrvmv8g6UGtchp:5kDkGa7HCP+lmCrXVxji8HbIp
TLSH	T1A3B533EF134CC1ED3DB15874236926F2621B282F92966D5F0C61EEC421F8D1EACEB845
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	1ZRR4H
Tags:	82.165.106.79 92.255.85.17 elf GoBrut Linux_amd64 StealthWorker

Intelligence

---

File Origin

# of uploads :

6

# of downloads :

324

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Siggen.4163.722.18628.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug stealthworker

Link:

https://www.filescan.io/uploads/627088e48d02701a7e955df0/reports/7fb714bf-0cf5-45d5-9a01-a26597524b06/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

25

Number of processes launched:

419

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

92.255.85.17:8888

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer gobrut

Malware family:

gobrut

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4160c118-ccf1-4857-a1a9-ae80b836c299

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/898547

Signature

Connects to many IPs within the same subnet mask (likely port scanning)

Executes the "crontab" command typically for achieving persistence

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Sample is packed with UPX

Sample tries to persist itself using cron

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to resolve many domain names, but no domain seems valid

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf/

ReversingLabs TitaniumCloud Linux.Trojan.Multiverze

Threat name:

Linux.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-11-14 17:32:51 UTC

File Type:

ELF64 Little (Exe)

AV detection:

17 of 40 (42.50%)

Threat level:

  5/5

Hatching Triage stealthworker

Result

Malware family:

stealthworker

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stealthworker antivm botnet linux suricata

Link:

https://tria.ge/reports/220503-b5tg3sfca5/

Behaviour

Reads runtime system information

Writes file to tmp directory

Modifies hosts file

Writes DNS configuration

Attempts to identify hypervisor via CPU configuration

StealthWorker

suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Activity

suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Checkin

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf