MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a
SHA3-384 hash:	31edac37d9252c63095ed7f7da04a525214914bbdd19d9ca7acf186cfffda5a2b3ae0e6304c54d8ab953e0ce8fa25f88
SHA1 hash:	440b6065b901187772edb40a288e9726a61bc8b3
MD5 hash:	9066ae099764c43c3f144f65b7a7ba7e
humanhash:	rugby-seventeen-venus-tango
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-06-22 04:45:59 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T1A9A40294E9819B62C2C801BBFF0F45BC77A31F65E1EA71068D16EB2662D745A4F7E400
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68578aa2b06783b9ebd68a42linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creates directories

Creating a process from a recently created file

Changes the time when the file was created, accessed, or modified

Creating a file

Creating a file in the %temp% directory

Connection attempt

Locks files

Opens a port

Changes access rights for a written file

Collects information on the CPU

Receives data from a server

Sends data to a server

DNS request

Runs as daemon

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 176.114.36.203:6881
type: 95.79.250.103:6881
type: 168.70.106.130:6881
type: 172.96.121.2:6881
type: 5.196.70.116:6881
type: 93.176.180.96:6881
type: 95.211.169.28:6881
type: 195.154.184.19:6881
type: 93.66.200.251:6881
type: 142.4.209.46:6881
type: 176.110.250.22:6881
type: 24.1.97.188:6881
type: 134.209.183.166:6881
type: 82.14.141.131:6881
type: 90.227.12.247:6881
type: 89.109.202.109:6881
type: 81.96.120.174:6881
type: 181.137.75.170:6881
type: 121.218.2.101:6881
type: 49.174.217.52:6881
type: 18.218.241.3:6881
type: 105.172.23.190:6881
type: 192.227.221.84:6881
type: 84.247.141.118:6881
type: 54.214.62.55:6881
type: 51.7.38.240:6881
type: 138.201.61.62:6881
type: 50.35.126.227:6881
type: 176.106.243.165:6881
type: 142.181.104.204:6881
type: 42.117.185.225:6881
type: 18.190.61.127:6881
type: 35.155.156.153:6881
type: 86.85.149.247:6881
type: 35.167.186.212:6881
type: 62.169.27.65:6881
type: 217.21.54.92:6881
type: 54.70.174.84:6881
type: 204.12.208.37:6881
type: 141.98.154.145:6881
type: 80.2.112.197:6881
type: 130.239.18.158:8516
type: 69.164.203.179:6880
type: 195.154.233.74:6880
type: 45.203.205.61:6880
type: 3.233.84.65:6880
type: 45.203.211.25:6880
type: 45.203.153.86:6880
type: 178.162.173.166:28000
type: 130.239.18.158:8580
type: 163.172.221.126:51413
type: 212.85.95.152:51413
type: 163.172.38.214:51413
type: 151.80.44.142:51413
type: 89.223.38.206:51413
type: 91.121.222.114:51413
type: 178.57.99.41:51413
type: 149.143.47.174:51413
type: 83.47.159.158:51413
type: 51.159.54.74:51413
type: 82.165.210.109:51413
type: 115.37.91.197:51413
type: 178.148.17.64:51413
type: 45.152.209.168:51413
type: 118.249.21.200:51413
type: 86.229.238.121:51413
type: 157.208.16.105:51413
type: 89.133.43.111:51413
type: 178.162.173.91:28003
type: 178.162.173.48:28003
type: 178.162.173.105:28003
type: 89.149.202.3:28003
type: 65.21.34.43:50000
type: 65.21.125.170:50000
type: 162.55.86.180:50000
type: 148.251.51.55:50000
type: 142.132.199.48:50000
type: 135.181.165.111:50000
type: 162.55.84.207:50000
type: 135.181.223.107:50000
type: 37.27.104.50:50000
type: 135.181.238.117:50000
type: 135.181.227.244:50000
type: 37.27.117.115:50000
type: 95.216.13.53:50000
type: 135.181.238.47:50000
type: 135.181.238.57:50000
type: 37.27.120.54:50000
type: 37.27.103.240:50000
type: 37.27.103.241:50000
type: 162.55.86.186:50000
type: 178.162.173.231:28005
type: 178.162.173.108:28005
type: 178.162.173.13:28010
type: 178.162.173.103:28010
type: 178.162.174.181:28010
type: 81.171.7.65:28010
type: 37.48.111.227:50184
type: 107.189.30.156:9671
type: 45.87.251.132:28083
type: 121.140.158.56:33144
type: 23.158.56.120:16074
type: 162.251.63.120:10086
type: 106.163.77.175:9020
type: 178.162.173.147:28007
type: 178.162.174.101:28007
type: 178.162.174.11:28007
type: 178.162.173.70:28007
type: 178.162.174.181:28007
type: 51.159.104.68:7606
type: 95.211.20.1:21170
type: 81.171.22.205:28013
type: 213.227.152.142:28013
type: 178.162.174.208:28013
type: 178.162.174.222:28014
type: 178.162.173.132:28014
type: 178.162.174.45:28002
type: 178.162.173.147:28002
type: 178.162.174.43:28004
type: 178.162.173.138:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 130.239.18.158:8501
type: 70.24.225.218:39861
type: 176.136.72.83:33744
type: 185.21.217.17:54150
type: 185.203.56.49:23780
type: 178.162.173.15:28006
type: 178.162.173.205:28015
type: 178.162.173.194:28015
type: 178.162.174.17:28008
type: 178.162.174.6:28008
type: 126.214.161.81:11337
type: 178.162.144.51:21183
type: 130.239.18.158:8510
type: 178.162.174.170:28001
type: 5.135.156.163:56843
type: 185.149.91.21:51118
type: 130.239.18.158:8520
type: 212.7.202.40:28030
type: 109.201.152.178:46908
type: 185.203.56.59:16107
type: 62.3.74.142:63029
type: 178.162.174.185:28011
type: 178.162.173.74:28011
type: 172.111.38.128:24027
type: 216.39.248.235:3972
type: 189.156.246.172:10341
type: 178.162.173.100:28012
type: 185.21.216.133:60195
type: 51.159.104.63:8695
type: 158.69.27.241:43789
type: 130.239.18.158:8526
type: 62.212.81.233:28009
type: 130.239.18.158:8513
type: 217.165.1.143:38006
type: 154.40.54.17:26881
type: 45.87.251.11:28052
type: 95.211.20.78:58919
type: 185.21.216.185:64284
type: 92.202.213.167:11429
type: 51.75.64.23:8645
type: 178.148.57.210:51273
type: 94.6.141.71:10386
type: 116.87.128.161:14082
type: 114.170.121.27:16902
type: 83.30.183.4:23707
type: 197.88.238.2:12901
type: 5.35.38.33:45645
type: 31.41.205.5:6889
type: 61.219.10.20:6889
type: 203.217.30.131:6889
type: 115.91.150.44:6889
type: 124.141.116.71:6889
type: 81.171.20.69:13152
type: 121.149.63.176:33054
type: 107.175.125.186:6923
type: 24.84.128.93:14114
type: 188.165.240.192:51065
type: 77.137.64.88:40895
type: 121.169.24.139:46049
type: 176.63.12.6:11852
type: 195.201.179.130:16389
type: 201.238.124.124:38617
type: 23.93.25.125:8360
type: 185.203.56.12:32415
type: 95.211.191.66:56322
type: 75.58.44.242:47387
type: 125.243.105.8:35981
type: 72.21.17.99:60389
type: 188.165.240.192:57708
type: 88.97.160.173:29627
type: 73.115.35.103:25046
type: 89.149.52.95:22260
type: 187.190.174.87:10133
type: 85.64.220.193:42569
type: 195.154.185.217:24807
type: 51.75.105.60:62735
type: 193.31.248.253:5001
type: 201.238.125.91:6166
type: 65.108.143.34:48752
type: 85.106.86.70:50801
type: 183.108.132.178:41119
type: 177.66.146.75:40718
type: 165.51.113.97:15091
type: 49.174.217.52:32973
type: 54.77.218.23:6992
type: 189.216.232.128:41194
type: 223.182.9.149:10455
type: 43.240.149.123:32681
type: 54.39.52.64:23883
type: 83.85.249.7:41939
type: 5.79.107.28:21189
type: 149.75.61.159:6383
type: 42.0.127.137:7660
type: 152.53.45.107:7039
type: 54.39.52.183:37249
type: 91.105.9.220:9089
type: 151.249.169.150:12032
type: 90.112.84.203:4078
type: 170.246.214.77:13888
type: 162.251.63.79:55276
type: 213.204.87.190:46652
type: 176.141.7.13:33609
type: 116.251.146.214:35944
type: 154.56.136.21:7182
type: 202.168.8.21:52398
type: 88.243.36.116:36056
type: 154.161.123.17:5716
type: 62.106.70.159:33933
type: 152.53.104.128:10240
type: 152.53.52.107:10240
type: 194.29.101.83:10240
type: 176.31.183.98:45302
type: 122.217.143.80:22311
type: 188.167.253.198:15089
type: 212.7.204.93:58984
type: 49.246.91.194:8151
type: 124.216.77.158:7861
type: 175.194.209.4:41833
type: 182.208.111.243:40926
type: 111.118.33.24:40567
type: 58.237.186.40:40976
type: 211.196.47.180:7593
type: 93.46.80.37:6893
type: 59.0.58.76:33095
type: 211.48.227.184:41114
type: 94.228.244.158:16769
type: 168.70.101.198:53333
type: 141.144.194.112:32157
type: 195.154.167.39:8684
type: 213.134.189.144:53417
type: 85.105.91.79:14638
type: 76.135.238.6:38708
type: 49.230.127.115:65179
type: 119.229.219.33:17764
type: 145.53.221.83:16881
type: 183.134.163.86:16881
type: 181.116.91.69:57594
type: 222.105.73.51:33362
type: 119.196.71.160:32927
type: 85.118.82.13:41330
type: 123.192.153.3:41154
type: 181.229.140.159:28814
type: 79.118.74.159:36987
type: 87.138.87.81:23633
type: 217.215.49.58:37603
type: 101.189.13.212:13790
type: 54.39.52.64:39450
type: 185.149.91.61:51035
type: 185.203.56.1:62095
type: 61.76.19.120:32889
type: 201.148.247.220:54259
type: 72.197.13.178:45925
type: 211.198.189.232:7752
type: 208.87.240.21:11162

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/80987a1c-6f5f-4c83-b0ac-70a8e48866d3

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a9b73403-d55c-46dc-ab39-db796770e6ec

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-22 04:46:23 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xr3t3j7srv665mj7cqtdzcbg5xrofrxjn2sskksyxrfllwrdif5a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250622-fd4k7axmt7/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/251ea71e-a597-4000-9d51-1132c4fe3054

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf bc773da7f28d7deeb13f14263c8826ede2e2c6e96ea5252a58bc4ab5da23417a

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558478/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample