MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3
SHA3-384 hash:	8501d9c0d319c32a19f13ff1e4617cf282ee55120050adfcd3cc206fa9d2cbcff13a4593b7f649be3c74dead7efc50cf
SHA1 hash:	9ec69a8bc6bd34e8ef1c73d52ea9d59534013626
MD5 hash:	e4864e5c9b44f76c374bde6e2687ae81
humanhash:	india-october-tango-washington
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-07-12 02:54:58 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T10CA41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB2662D745A4F7E400
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6871ce95900df8e7f86a03fflinux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

DNS request

Changes access rights for a written file

Locks files

Changes the time when the file was created, accessed, or modified

Collects information on the CPU

Receives data from a server

Creating a file

Runs as daemon

Connection attempt

Creating a file in the %temp% directory

Opens a port

Launching a process

Sends data to a server

Creating a process from a recently created file

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc rust

Link:

https://www.filescan.io/uploads/6871ce951bf7248a9289b99b/reports/38c4afda-3650-44b0-9e93-b9429ad4bd02/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 91.146.40.226:6881
type: 70.71.249.93:6881
type: 84.255.244.61:6881
type: 134.209.183.166:6881
type: 107.197.174.157:6881
type: 188.186.73.198:6881
type: 95.79.250.103:6881
type: 172.96.121.2:6881
type: 73.208.41.226:6881
type: 193.233.182.44:6881
type: 89.179.246.14:6881
type: 202.21.11.250:6881
type: 37.85.63.112:6881
type: 70.75.206.190:6881
type: 94.75.194.21:6881
type: 84.255.205.181:6881
type: 104.255.18.103:6881
type: 182.216.108.228:6881
type: 86.98.23.38:6881
type: 193.150.213.75:6881
type: 186.227.249.248:6881
type: 81.88.147.228:6881
type: 122.151.154.229:6881
type: 217.43.56.50:6881
type: 62.49.131.116:6881
type: 86.17.251.43:6881
type: 46.61.13.207:6881
type: 36.2.95.146:6881
type: 46.39.80.138:6881
type: 35.155.156.153:6881
type: 18.191.2.28:6881
type: 52.9.197.152:6881
type: 18.188.31.0:6881
type: 54.214.62.55:6881
type: 179.1.241.15:6881
type: 18.223.137.220:6881
type: 54.70.174.84:6881
type: 144.208.201.180:6881
type: 39.184.194.11:6881
type: 176.102.68.195:6881
type: 91.121.148.35:6881
type: 109.67.162.1:6881
type: 88.98.93.170:6881
type: 24.200.117.239:6881
type: 74.12.162.174:6881
type: 91.82.247.163:6881
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 195.154.233.74:6880
type: 3.138.130.148:6880
type: 34.192.33.74:6880
type: 18.117.46.179:6880
type: 148.153.188.226:6880
type: 44.195.180.169:6880
type: 69.164.203.179:6880
type: 52.20.184.242:6880
type: 130.239.18.158:8580
type: 222.0.129.136:51413
type: 134.249.57.173:51413
type: 162.19.243.205:51413
type: 45.152.210.99:51413
type: 46.138.241.181:51413
type: 188.90.169.20:51413
type: 31.173.93.165:51413
type: 185.13.36.21:51413
type: 80.253.93.152:51413
type: 45.128.27.97:51413
type: 82.68.178.38:51413
type: 109.146.143.181:51413
type: 37.59.59.214:51413
type: 95.31.204.33:51413
type: 101.110.20.1:51413
type: 14.179.170.0:51413
type: 51.38.238.141:51413
type: 5.2.70.28:51413
type: 37.142.137.48:51413
type: 178.162.174.43:28004
type: 94.75.234.248:28004
type: 178.162.174.170:28001
type: 178.162.174.149:28001
type: 72.21.17.24:16049
type: 178.162.174.210:28015
type: 135.181.227.244:50000
type: 65.21.128.214:50000
type: 135.181.238.113:50000
type: 65.108.102.46:50000
type: 65.21.128.230:50000
type: 37.27.120.58:50000
type: 65.21.129.41:50000
type: 37.27.117.54:50000
type: 135.181.238.48:50000
type: 65.21.34.43:50000
type: 65.21.125.170:50000
type: 135.181.238.57:50000
type: 195.201.153.69:50000
type: 144.76.238.207:50000
type: 37.27.119.182:50000
type: 95.216.13.168:50000
type: 142.132.193.99:50000
type: 37.27.117.188:50000
type: 37.27.119.185:50000
type: 130.239.18.158:8521
type: 178.162.173.120:28007
type: 178.162.173.167:28007
type: 178.162.173.2:28007
type: 178.162.174.11:28007
type: 131.100.161.153:28912
type: 178.162.174.17:28008
type: 178.162.174.221:28009
type: 178.162.173.57:28009
type: 51.75.163.151:8643
type: 178.162.173.154:28006
type: 5.79.83.114:28006
type: 178.162.173.210:28006
type: 178.162.174.231:28006
type: 178.162.173.166:28006
type: 178.162.173.90:28006
type: 179.209.45.255:32591
type: 130.239.18.158:8525
type: 185.203.56.69:12282
type: 178.162.173.153:28012
type: 89.149.202.13:28012
type: 36.255.6.230:43093
type: 204.216.222.117:1434
type: 104.195.12.36:1434
type: 95.211.247.106:28005
type: 178.162.174.159:28005
type: 178.162.173.159:28005
type: 45.87.251.132:28119
type: 178.162.173.98:28011
type: 95.211.228.35:52451
type: 94.75.194.118:28014
type: 178.162.174.162:28014
type: 178.162.174.222:28014
type: 185.21.216.155:55947
type: 93.165.253.18:31018
type: 46.232.211.210:17809
type: 81.226.201.46:13509
type: 178.162.174.55:28003
type: 5.79.122.78:28003
type: 178.162.173.91:28003
type: 178.162.173.38:28010
type: 81.171.7.65:28010
type: 178.162.174.171:28010
type: 178.162.173.36:28002
type: 178.162.174.58:28002
type: 130.239.18.158:8501
type: 45.87.251.11:28127
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 178.162.144.51:21183
type: 130.239.18.158:8510
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 78.194.26.148:49001
type: 92.140.207.211:49001
type: 126.78.237.189:49001
type: 77.34.231.37:49001
type: 95.79.201.78:49001
type: 46.232.211.148:17659
type: 216.121.144.8:50721
type: 185.203.56.49:17129
type: 72.21.17.12:61112
type: 5.2.130.18:17970
type: 109.186.99.70:16911
type: 93.50.247.138:6882
type: 64.147.89.209:6882
type: 24.5.143.239:6882
type: 159.203.67.164:8000
type: 159.223.162.113:8083
type: 130.239.18.158:8597
type: 46.4.250.108:53753
type: 45.132.235.228:51414
type: 52.68.109.216:29265
type: 5.79.77.60:64686
type: 37.48.83.137:63881
type: 36.239.202.200:18027
type: 195.154.167.107:8656
type: 202.166.176.146:6889
type: 94.64.199.209:6889
type: 108.18.202.59:6889
type: 73.63.53.212:6889
type: 178.26.31.81:6889
type: 79.100.209.119:59165
type: 185.200.117.131:21037
type: 176.241.139.219:63221
type: 217.182.61.86:8655
type: 14.36.12.163:57577
type: 169.150.223.233:64018
type: 82.2.45.213:64404
type: 37.27.113.233:28462
type: 78.96.82.52:21670
type: 211.248.211.115:7687
type: 71.196.228.78:57824
type: 72.21.17.41:21124
type: 84.122.113.156:6895
type: 218.146.214.209:41161
type: 188.165.246.171:51118
type: 23.94.91.154:8999
type: 125.246.244.91:24135
type: 78.8.163.235:30914
type: 176.31.183.108:56044
type: 172.245.82.221:59509
type: 190.164.6.179:41955
type: 24.128.9.180:43377
type: 125.237.77.19:64320
type: 169.150.223.223:21759
type: 138.199.53.231:43631
type: 46.232.211.56:64057
type: 46.232.211.56:64152
type: 197.167.178.101:3334
type: 174.173.197.251:30324
type: 112.162.97.80:40991
type: 220.86.61.135:63334
type: 178.238.225.109:63841
type: 95.98.179.162:41399
type: 38.25.53.214:36118
type: 73.215.227.47:15624
type: 124.5.55.8:32848
type: 182.227.83.119:32900
type: 14.202.25.204:49777
type: 80.99.57.196:47406
type: 82.67.96.233:53264
type: 176.40.39.186:39508
type: 90.247.210.105:15816
type: 90.95.20.166:51416
type: 24.90.14.6:44683
type: 24.160.201.180:42834
type: 190.115.64.134:22419
type: 68.102.163.77:49944
type: 108.172.39.174:45456
type: 188.81.241.107:46023
type: 201.24.233.107:56031
type: 222.100.190.115:44771
type: 65.108.143.34:44841
type: 190.104.118.85:63484
type: 188.119.36.176:22901
type: 109.134.176.157:40659
type: 95.214.53.172:1688
type: 35.171.49.86:6992
type: 13.114.205.93:6992
type: 176.228.3.114:54406
type: 54.209.131.199:6892
type: 13.114.205.93:6892
type: 104.221.226.31:51055
type: 103.210.101.186:4034
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 69.87.207.136:9118
type: 103.81.113.15:16414
type: 84.15.183.199:15274
type: 188.165.244.171:52003
type: 130.239.18.158:8565
type: 80.94.240.130:58859
type: 83.149.106.135:58859
type: 37.59.61.17:52295
type: 91.199.227.110:10347
type: 124.168.17.190:27709
type: 59.138.212.196:26245
type: 58.177.174.75:15617
type: 185.145.245.121:8690
type: 51.195.223.60:8650
type: 51.75.73.209:8649
type: 5.58.27.75:17398
type: 222.104.85.165:7724
type: 106.221.114.144:48455
type: 82.154.225.247:32000
type: 176.37.21.64:32000
type: 67.8.237.128:15659
type: 38.222.228.44:56575
type: 46.34.226.70:10420
type: 197.95.145.174:45302
type: 185.203.56.53:25320

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/946fa2c0-d1c4-4494-aed5-ea70e8f0531a

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e1166c6a-2d94-48cc-9d83-f3e207cefc5e

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-07-12 02:55:17 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vcen7lmxgr46wycjvmm72f6cckehtv3p3ncn5ulbn52s7xkc7hbq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250712-dehn1awsbz/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7b8b9d85-4651-49b7-930e-d020e2d18b1d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf a888dfad973479eb6049ab19fd17c2128879d76fdb44ded1616f752fdd42f9c3

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558169/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample