MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2
SHA3-384 hash: 0a549f444ee688d65848ac85eae8b831787a7eb9514db2aaf596976b98db4042fd23901ab9018028b93192507afe2547
SHA1 hash: 20e4df045e86465dfe8e38218f0eff72ac07a011
MD5 hash: d0de96c44c196871d00e604f2e61859b
humanhash: three-orange-bacon-harry
File name:amd64
Download: download sample
File size:482'032 bytes
First seen:2025-06-30 10:28:03 UTC
Last seen:2025-06-30 11:20:23 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR
TLSH T10DA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9080.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686272c30fceda814b474108linux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creates directories
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
70
Number of processes launched:
10
Processes remaning?
true
Remote TCP ports scanned:
47354
Full report:
https://elfdigest.com/brief/af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2
Behaviour
Anti-VM
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 188.187.99.27:6881
type: 94.75.211.142:6881
type: 85.144.253.132:6881
type: 94.154.224.175:6881
type: 46.150.56.115:6881
type: 95.37.26.86:6881
type: 134.209.183.166:6881
type: 185.81.22.42:6881
type: 80.194.211.166:6881
type: 188.24.33.154:6881
type: 82.66.62.4:6881
type: 5.228.137.67:6881
type: 185.246.33.53:6881
type: 94.198.235.90:6881
type: 77.34.122.153:6881
type: 81.167.188.239:6881
type: 82.192.54.92:6881
type: 210.50.236.29:6881
type: 35.155.156.153:6881
type: 115.246.184.236:6881
type: 18.223.137.220:6881
type: 142.171.58.199:6881
type: 75.119.138.164:6881
type: 193.237.232.155:6881
type: 194.5.61.226:6881
type: 142.171.125.191:6881
type: 167.99.72.189:6881
type: 178.206.67.13:6881
type: 101.127.149.109:6881
type: 212.34.124.112:6881
type: 89.160.118.147:6881
type: 217.86.250.223:6881
type: 78.30.194.59:6881
type: 89.254.249.230:6881
type: 190.17.82.107:6881
type: 178.162.174.222:28014
type: 178.162.173.226:28014
type: 178.162.173.199:28014
type: 178.162.174.77:28014
type: 178.162.174.88:28014
type: 141.95.53.34:8648
type: 79.106.231.163:1434
type: 130.239.18.158:8515
type: 135.181.227.244:50000
type: 135.181.76.212:50000
type: 65.21.128.209:50000
type: 65.21.125.172:50000
type: 65.21.125.161:50000
type: 65.108.194.186:50000
type: 65.21.125.160:50000
type: 37.27.104.57:50000
type: 162.55.81.226:50000
type: 135.181.238.57:50000
type: 148.251.124.43:50000
type: 45.203.208.35:6880
type: 195.154.233.74:6880
type: 52.21.231.83:6880
type: 54.144.88.168:6880
type: 35.171.213.155:6880
type: 185.149.91.21:51118
type: 51.159.104.80:8319
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 178.162.173.149:28004
type: 5.135.178.12:53659
type: 46.232.211.193:58017
type: 178.162.174.228:28007
type: 178.162.173.89:28007
type: 67.220.85.98:10070
type: 5.135.165.33:6331
type: 69.50.95.40:10085
type: 178.162.173.134:28016
type: 36.70.233.89:20145
type: 178.162.174.169:28003
type: 178.162.173.91:28003
type: 178.162.174.227:28003
type: 46.232.210.157:64170
type: 31.210.173.50:27520
type: 82.172.167.161:6889
type: 87.206.61.118:6889
type: 79.11.107.190:6889
type: 81.215.218.135:6889
type: 159.93.71.250:6889
type: 192.116.53.0:6889
type: 82.85.55.177:6889
type: 185.183.32.101:6887
type: 118.104.227.36:20242
type: 142.202.48.88:10056
type: 23.158.56.120:10072
type: 202.75.233.41:12331
type: 69.50.95.40:10016
type: 195.154.178.118:8680
type: 178.162.174.50:28010
type: 178.162.174.169:28010
type: 78.129.168.50:56912
type: 116.203.122.81:57009
type: 51.158.148.71:57487
type: 95.211.19.32:50315
type: 141.95.53.34:8662
type: 169.0.162.170:64927
type: 61.239.42.209:9010
type: 188.150.42.185:8080
type: 45.155.90.140:8080
type: 130.239.18.158:8580
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 152.67.102.236:51413
type: 45.83.232.30:51413
type: 104.244.73.2:51413
type: 68.205.35.129:51413
type: 176.137.95.150:51413
type: 76.223.228.223:51413
type: 39.86.111.20:51413
type: 95.211.148.228:51413
type: 139.162.187.40:51413
type: 173.47.145.130:51413
type: 80.57.158.253:51413
type: 176.212.64.233:51413
type: 93.89.141.246:51413
type: 213.81.197.186:51413
type: 77.239.226.78:51413
type: 185.57.5.216:55086
type: 42.200.253.141:7459
type: 185.149.91.185:51059
type: 104.234.173.77:4009
type: 172.111.38.128:26084
type: 195.154.171.138:30519
type: 95.211.247.101:28013
type: 213.227.151.25:28013
type: 212.7.200.93:23999
type: 218.164.143.243:10757
type: 88.198.230.221:49668
type: 185.21.216.185:60731
type: 61.93.212.126:54241
type: 185.206.225.51:12046
type: 136.30.190.15:43489
type: 5.79.79.145:28001
type: 178.162.174.43:28001
type: 178.162.174.53:28001
type: 24.130.213.236:15248
type: 217.178.132.41:29403
type: 186.134.67.134:41586
type: 23.158.56.120:12054
type: 46.232.211.200:11909
type: 178.162.174.222:28011
type: 178.162.173.48:28011
type: 178.162.174.180:28011
type: 178.162.173.23:28011
type: 45.91.208.243:51936
type: 37.48.89.181:48531
type: 178.162.173.141:28000
type: 185.107.71.103:44737
type: 185.149.91.145:51509
type: 195.154.170.6:8652
type: 81.44.69.209:49164
type: 5.79.66.11:54337
type: 178.162.173.153:28012
type: 178.162.174.163:28012
type: 95.211.247.101:28009
type: 178.162.173.231:28009
type: 213.232.235.11:8999
type: 5.135.156.163:56843
type: 130.239.18.158:8524
type: 209.141.37.116:51001
type: 156.155.38.171:16720
type: 60.227.61.38:49001
type: 90.188.252.1:49001
type: 45.141.234.94:49001
type: 184.22.32.1:49001
type: 192.30.89.67:54961
type: 46.232.211.148:11059
type: 185.145.245.121:8657
type: 119.203.34.48:63906
type: 76.146.50.217:26711
type: 57.129.45.78:8642
type: 51.38.81.212:8642
type: 185.183.34.95:6884
type: 46.232.211.98:14259
type: 27.59.236.172:19426
type: 193.32.16.59:52278
type: 154.118.111.58:29394
type: 70.68.244.14:55945
type: 200.93.46.75:24823
type: 76.155.65.221:55280
type: 62.210.201.217:8645
type: 185.203.56.72:17868
type: 94.67.208.92:52126
type: 194.62.248.9:45795
type: 84.30.67.154:57149
type: 144.76.175.153:32715
type: 174.95.155.153:61765
type: 79.100.43.43:13983
type: 45.87.250.202:54058
type: 47.156.84.72:46423
type: 95.168.162.200:55687
type: 185.203.56.11:55079
type: 200.122.73.179:42504
type: 79.121.94.57:20539
type: 80.72.70.187:33852
type: 94.41.210.242:42549
type: 185.203.56.11:64076
type: 46.232.210.16:64040
type: 212.102.37.194:50510
type: 85.107.81.28:30286
type: 189.143.227.90:28703
type: 121.183.151.27:33532
type: 180.150.61.29:59877
type: 185.241.227.57:64166
type: 37.48.118.19:28006
type: 78.137.204.8:18357
type: 189.135.62.12:56456
type: 208.87.240.21:11158
type: 54.39.52.64:39450
type: 66.70.178.54:24113
type: 210.6.119.34:51236
type: 195.154.185.217:24205
type: 46.98.134.51:46435
type: 176.238.132.196:8281
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 90.227.50.5:6426
type: 130.195.242.5:45485
type: 141.95.53.34:8650
type: 195.201.179.130:16489
type: 66.131.219.177:40763
type: 83.50.201.197:8967
type: 178.162.173.220:28002
type: 223.197.133.194:7830
type: 86.26.205.226:62469
type: 95.214.230.93:59829
type: 185.203.56.51:61012
type: 181.45.168.216:13831
type: 220.133.85.151:31415
type: 186.13.209.15:24392
type: 46.232.210.157:58039
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/731087c2-8d9f-4b3d-8cfd-7cd12c3f2826
Behavior Graph:
Download SVG
%3 guuid=5e74bdb6-1800-0000-acb6-70ad620c0000 pid=3170 /usr/bin/sudo guuid=3cfadeb8-1800-0000-acb6-70ad650c0000 pid=3173 /tmp/sample.bin guuid=5e74bdb6-1800-0000-acb6-70ad620c0000 pid=3170->guuid=3cfadeb8-1800-0000-acb6-70ad650c0000 pid=3173 execve guuid=a66226b9-1800-0000-acb6-70ad660c0000 pid=3174 /usr/bin/dash guuid=3cfadeb8-1800-0000-acb6-70ad650c0000 pid=3173->guuid=a66226b9-1800-0000-acb6-70ad660c0000 pid=3174 execve guuid=1f15afb9-1800-0000-acb6-70ad670c0000 pid=3175 /usr/bin/dash guuid=3cfadeb8-1800-0000-acb6-70ad650c0000 pid=3173->guuid=1f15afb9-1800-0000-acb6-70ad670c0000 pid=3175 execve guuid=76d117ba-1800-0000-acb6-70ad6a0c0000 pid=3178 /tmp/sample.bin mprotect-exec zombie guuid=3cfadeb8-1800-0000-acb6-70ad650c0000 pid=3173->guuid=76d117ba-1800-0000-acb6-70ad6a0c0000 pid=3178 clone guuid=cfbae8b9-1800-0000-acb6-70ad680c0000 pid=3176 /usr/bin/dash guuid=1f15afb9-1800-0000-acb6-70ad670c0000 pid=3175->guuid=cfbae8b9-1800-0000-acb6-70ad680c0000 pid=3176 clone guuid=5142f2b9-1800-0000-acb6-70ad690c0000 pid=3177 /usr/bin/dash guuid=1f15afb9-1800-0000-acb6-70ad670c0000 pid=3175->guuid=5142f2b9-1800-0000-acb6-70ad690c0000 pid=3177 clone guuid=2afa58c2-1800-0000-acb6-70ad6b0c0000 pid=3179 /tmp/sample.bin zombie guuid=76d117ba-1800-0000-acb6-70ad6a0c0000 pid=3178->guuid=2afa58c2-1800-0000-acb6-70ad6b0c0000 pid=3179 clone guuid=a4e96cc2-1800-0000-acb6-70ad6c0c0000 pid=3180 /tmp/sample.bin guuid=2afa58c2-1800-0000-acb6-70ad6b0c0000 pid=3179->guuid=a4e96cc2-1800-0000-acb6-70ad6c0c0000 pid=3180 clone guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181 /tmp/sample.bin dns net net-scan send-data guuid=a4e96cc2-1800-0000-acb6-70ad6c0c0000 pid=3180->guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181 clone d316b2ae-0a7e-5b43-8de6-745900c90c54 127.0.0.1:65535 guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181->d316b2ae-0a7e-5b43-8de6-745900c90c54 con 38a4910e-6f05-5afe-a8e3-398c2eb18329 time.cloudflare.com:123 guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181->38a4910e-6f05-5afe-a8e3-398c2eb18329 send: 48B 83246ee4-adae-55a6-8f7e-0b140605936e 121.186.165.84:57174 guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181->83246ee4-adae-55a6-8f7e-0b140605936e con guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181|send-data send-data to 268 IP addresses review logs to see them all guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181->guuid=7d6a77c2-1800-0000-acb6-70ad6d0c0000 pid=3181|send-data send
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/055f882d-41ed-41d3-a6d2-412193bef1e0
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1725416
Signature
Executes the "crontab" command typically for achieving persistence
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1725416 Sample: amd64.elf Startdate: 30/06/2025 Architecture: LINUX Score: 56 37 105.235.135.58, 47960 wataniya-telecom-asDZ Algeria 2->37 39 197.186.4.185, 1763 airtel-tz-asTZ Tanzania United Republic of 2->39 41 101 other IPs or domains 2->41 9 amd64.elf 2->9         started        process3 process4 11 amd64.elf sh 9->11         started        13 amd64.elf 9->13         started        16 amd64.elf sh 9->16         started        signatures5 18 sh crontab 11->18         started        22 sh 11->22         started        49 Opens /sys/class/net/* files useful for querying network interface information 13->49 51 Sample reads /proc/mounts (often used for finding a writable filesystem) 13->51 24 amd64.elf 13->24         started        26 sh crontab 16->26         started        process6 file7 35 /var/spool/cron/crontabs/tmp.n6fnTR, ASCII 18->35 dropped 43 Sample tries to persist itself using cron 18->43 45 Executes the "crontab" command typically for achieving persistence 18->45 28 sh crontab 22->28         started        31 amd64.elf 24->31         started        signatures8 process9 signatures10 47 Executes the "crontab" command typically for achieving persistence 28->47 33 amd64.elf 31->33         started        process11
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-06-30 11:37:02 UTC
File Type:
ELF64 Little (Exe)
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6kdwrh4i2syjvhzpi53dwci5a4kjtbb75v6cfefs2pgezwkxora._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/250630-nr6xgadl2t/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3e81daf4-9942-4e54-b207-7b35e29e00f6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:enterpriseunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise UNIX
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf af943b44fc46a584d4f97a3bb1d848e838a4cc21ff6be11485969e6266cabba2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3550686/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments