MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe
SHA3-384 hash: 68f6eb667c102d7c6867d0e43f5b436498a13d92dc95e839450f050dc27633578d13caa4ce9b30dc5cdaabdfb6e1bb54
SHA1 hash: 328a28a2f1604e9cb68f22947948e61054af9d2d
MD5 hash: dece045dd7eb8bf94d30a2c1e1ee6d29
humanhash: fillet-double-shade-connecticut
File name:mips
Download: download sample
File size:592'688 bytes
First seen:2025-06-06 09:52:43 UTC
Last seen:2025-06-07 00:15:55 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zg:W7v+mrY2xzf03yvZ/YIA
TLSH T1C1C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9084.12630.25511.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6842bad08bd5d68a12e5e586linux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
Creating a process from a recently created file
Connection attempt
Changes access rights for a written file
Receives data from a server
Locks files
DNS request
Opens a port
Sends data to a server
Launching a process
Changes the time when the file was created, accessed, or modified
Creating a file
Creates directories
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
exploit gcc lolbin remote
Link:
https://www.filescan.io/uploads/6842ba93fd02ed5e059bbd8f/reports/01ff5ef9-c514-4e99-850d-8bcc2b11e049/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
mips
Packer:
custom
Botnet:
unknown
Number of open files:
60
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 81.171.17.83:6881
type: 176.110.250.22:6881
type: 87.227.32.92:6881
type: 38.242.183.122:6881
type: 23.88.96.103:6881
type: 138.201.118.174:6881
type: 188.42.55.92:6881
type: 5.135.165.160:6881
type: 178.69.209.93:6881
type: 93.176.180.96:6881
type: 109.228.171.236:6881
type: 77.33.51.155:6881
type: 83.69.80.56:6881
type: 5.196.70.116:6881
type: 110.67.31.7:6881
type: 89.212.178.105:6881
type: 46.48.19.174:6881
type: 188.27.108.203:6881
type: 203.21.47.4:6881
type: 180.57.184.212:6881
type: 180.199.85.250:6881
type: 93.50.248.5:6881
type: 91.234.69.214:6881
type: 86.14.38.105:6881
type: 81.184.145.207:6881
type: 46.241.58.119:6881
type: 37.187.23.138:6881
type: 95.221.211.0:6881
type: 176.192.214.28:6881
type: 85.238.42.36:6881
type: 54.214.105.212:6881
type: 37.203.254.147:6881
type: 124.170.108.215:6881
type: 118.36.27.85:6881
type: 124.135.196.226:6881
type: 35.155.156.153:6881
type: 52.9.197.152:6881
type: 2.125.173.69:6881
type: 54.70.174.84:6881
type: 54.214.62.55:6881
type: 170.39.226.203:6881
type: 35.163.251.58:6881
type: 18.190.61.127:6881
type: 101.188.86.110:6881
type: 107.173.127.249:6881
type: 209.141.40.204:6881
type: 73.8.176.118:6881
type: 118.223.178.93:6881
type: 64.150.129.68:6881
type: 130.239.18.158:8516
type: 69.164.203.179:6880
type: 195.154.233.74:6880
type: 173.230.130.111:6880
type: 18.189.93.241:6880
type: 45.203.151.81:6880
type: 204.216.110.139:35284
type: 178.162.173.91:28003
type: 178.162.174.232:28003
type: 178.162.174.178:28003
type: 178.162.173.105:28003
type: 178.162.173.32:28003
type: 130.239.18.158:8580
type: 45.151.107.0:50838
type: 72.167.132.34:24220
type: 62.212.81.233:28009
type: 95.211.198.83:28009
type: 133.130.116.144:51413
type: 5.227.31.125:51413
type: 149.107.55.225:51413
type: 37.187.78.72:51413
type: 94.75.250.165:51413
type: 109.247.28.135:51413
type: 37.187.72.183:51413
type: 193.23.249.79:51413
type: 95.168.174.167:51413
type: 85.17.183.248:51413
type: 95.211.249.103:51413
type: 51.15.211.112:51413
type: 5.135.165.49:51413
type: 81.171.22.68:51413
type: 79.98.44.251:51413
type: 79.218.238.51:51413
type: 119.18.12.166:51413
type: 218.148.160.99:51413
type: 90.188.3.81:51413
type: 167.86.86.31:51413
type: 188.165.221.61:51413
type: 94.142.246.146:51413
type: 130.239.18.158:8513
type: 193.32.23.253:55159
type: 178.162.174.110:28000
type: 178.162.173.166:28000
type: 178.162.174.88:28014
type: 178.162.173.220:28014
type: 178.162.174.222:28014
type: 178.162.174.163:28014
type: 95.211.198.7:28014
type: 178.162.173.10:28014
type: 178.162.173.218:28014
type: 65.21.34.43:50000
type: 37.27.104.56:50000
type: 37.27.117.115:50000
type: 162.55.84.207:50000
type: 65.21.125.170:50000
type: 144.76.57.15:50000
type: 65.21.128.235:50000
type: 37.27.117.240:50000
type: 37.27.117.55:50000
type: 116.202.213.48:50000
type: 178.162.173.9:28002
type: 130.239.18.158:8539
type: 89.149.200.92:28027
type: 93.100.188.209:47369
type: 51.83.251.34:15000
type: 223.75.33.220:15000
type: 188.226.210.44:5060
type: 23.158.56.120:18048
type: 178.162.144.51:21183
type: 150.241.105.250:50276
type: 23.158.56.120:18031
type: 37.48.64.29:28005
type: 178.162.173.108:28005
type: 213.227.152.67:28005
type: 178.162.173.51:28006
type: 178.162.174.143:28006
type: 37.48.116.206:55201
type: 163.172.13.241:58761
type: 130.239.18.158:8508
type: 46.232.211.190:13709
type: 178.162.173.231:28001
type: 178.162.174.170:28001
type: 178.162.174.58:28001
type: 200.24.13.247:56882
type: 94.175.54.156:50413
type: 2.34.97.70:1696
type: 178.162.174.169:28010
type: 178.162.173.92:28010
type: 213.227.152.73:28010
type: 178.162.174.205:28010
type: 178.162.173.36:28010
type: 178.162.174.43:28004
type: 178.162.173.208:28004
type: 178.162.173.149:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 130.239.18.158:8510
type: 77.37.132.206:5222
type: 188.165.195.203:56140
type: 178.141.242.58:8709
type: 185.149.91.21:51118
type: 130.239.18.158:8520
type: 23.158.56.120:14055
type: 212.7.202.40:28030
type: 185.149.91.171:51078
type: 178.162.174.184:28008
type: 46.232.211.167:23509
type: 195.154.172.179:26214
type: 5.39.85.82:50178
type: 83.149.98.181:28013
type: 109.104.55.8:56638
type: 77.37.231.21:11728
type: 45.87.251.132:28129
type: 62.3.74.142:63029
type: 89.149.222.67:21179
type: 178.162.174.185:28011
type: 46.232.211.180:51539
type: 178.162.174.168:28012
type: 45.87.251.132:28021
type: 158.69.27.241:43789
type: 130.239.18.158:8526
type: 185.183.32.101:6890
type: 5.3.105.32:58887
type: 82.64.2.200:21433
type: 178.71.246.193:1024
type: 91.132.23.17:1024
type: 92.238.80.215:10993
type: 85.15.121.109:25411
type: 103.204.117.196:15108
type: 185.203.56.71:18698
type: 77.102.230.182:6882
type: 94.23.215.83:6882
type: 54.194.124.68:6882
type: 72.21.17.72:53126
type: 169.150.223.223:64309
type: 51.159.104.84:7199
type: 184.160.99.71:14856
type: 38.114.67.45:17925
type: 31.208.133.219:6889
type: 39.111.117.143:6889
type: 108.160.86.56:6889
type: 87.4.13.202:6889
type: 75.43.153.10:6889
type: 24.129.194.40:6889
type: 222.228.238.6:1868
type: 107.189.12.138:50840
type: 145.255.9.185:4272
type: 95.84.206.229:33715
type: 217.150.74.151:6663
type: 46.150.80.203:63228
type: 195.154.185.217:22633
type: 85.144.150.46:56979
type: 75.83.196.69:9011
type: 169.150.223.248:64163
type: 62.210.201.217:8679
type: 109.186.200.28:25758
type: 212.7.200.200:4190
type: 185.112.83.6:33397
type: 176.52.52.84:1668
type: 46.49.49.35:5245
type: 85.65.190.9:44272
type: 81.106.163.174:45980
type: 78.128.50.45:17653
type: 62.210.201.217:8647
type: 188.163.108.165:1814
type: 87.249.61.167:1913
type: 164.138.93.66:3085
type: 169.150.251.167:27979
type: 115.96.14.163:4936
type: 176.12.21.53:34441
type: 188.83.181.207:62135
type: 118.93.112.23:43391
type: 201.41.170.23:55370
type: 46.175.231.105:55657
type: 150.249.132.35:18446
type: 212.119.194.199:18864
type: 210.56.243.210:60407
type: 188.165.200.139:59876
type: 46.150.82.72:50354
type: 190.92.42.96:48944
type: 91.149.80.84:7700
type: 37.99.86.131:39420
type: 106.205.173.69:10244
type: 176.222.6.19:64158
type: 188.32.135.142:64423
type: 146.56.113.49:7881
type: 156.197.187.157:14773
type: 152.53.45.107:7143
type: 178.216.34.32:49167
type: 54.39.52.64:48853
type: 54.77.218.23:6892
type: 185.132.179.61:6892
type: 46.150.65.89:18709
type: 50.60.123.146:13747
type: 95.214.53.172:1688
type: 152.53.45.107:7237
type: 152.53.45.107:7087
type: 176.111.176.163:19251
type: 23.158.56.119:10044
type: 106.209.243.192:14512
type: 54.209.131.199:6992
type: 87.90.160.230:54192
type: 23.158.56.120:18010
type: 103.252.200.238:8681
type: 37.27.113.233:32644
type: 68.224.152.6:5467
type: 72.21.17.86:27892
type: 73.151.4.115:25124
type: 89.23.2.197:2880
type: 178.162.174.228:28007
type: 51.158.148.71:53395
type: 118.236.154.148:21422
type: 91.92.89.134:40664
type: 89.172.210.132:56196
type: 76.141.250.101:63547
type: 89.39.117.28:38960
type: 94.16.104.77:8323
type: 46.232.211.161:64248
type: 46.174.81.217:2023
type: 145.255.10.235:33594
type: 88.8.19.200:39178
type: 194.210.250.15:63489
type: 222.107.201.11:11749
type: 5.79.98.160:61942
type: 90.70.28.162:21995
type: 185.203.56.23:64424
type: 176.63.3.138:16365
type: 172.251.229.36:14538
type: 152.53.52.107:10240
type: 37.48.95.188:55305
type: 84.204.72.150:47115
type: 91.121.222.191:64652
type: 83.69.214.109:23653
type: 118.232.115.178:35235
type: 104.37.173.217:7973
type: 186.22.16.203:9376
type: 213.176.246.117:9881
type: 84.50.58.6:23112
type: 79.139.219.21:1309
type: 206.119.151.238:51361
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8438f288-b886-40c1-b580-b0410401dd14
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1708065
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1708065 Sample: mips.elf Startdate: 06/06/2025 Architecture: LINUX Score: 72 38 5.16.164.57, 35404, 6881 ZTELECOM-ASRU Russian Federation 2->38 40 63.135.74.3, 51797 WVFIBER-1US United States 2->40 42 102 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Connects to many ports of the same IP (likely port scanning) 2->46 48 Uses known network protocols on non-standard ports 2->48 10 mips.elf configuration 2->10         started        signatures3 process4 process5 12 mips.elf sh 10->12         started        14 configuration 10->14         started        17 mips.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        56 Opens /sys/class/net/* files useful for querying network interface information 14->56 58 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->58 25 configuration 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.UdNXSu, ASCII 19->36 dropped 50 Sample tries to persist itself using cron 19->50 52 Executes the "crontab" command typically for achieving persistence 19->52 29 sh crontab 23->29         started        32 configuration 25->32         started        signatures9 process10 signatures11 54 Executes the "crontab" command typically for achieving persistence 29->54 34 configuration 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-06 09:53:24 UTC
File Type:
ELF32 Big (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhryxkd5yq73xpktcmdeqexbou3hlt4hka6gprc3jdxkbx4p377a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250606-lwsvasyyf1/
Behaviour
System Network Configuration Discovery
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/973b08d0-17cc-4485-8b0f-b8538ccee5bd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf b9e38ba87dc43fbbbd5313064812e1753675cf87503c67c45b48eea0df8fdffe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3558165/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments