MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedXOR


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3
SHA3-384 hash: e311c6e89ef1a558bf4b20b343502f8755fe1588c1ae1647c664887c8bd61da069fa7b3660115999cf9bfabff9cf33d0
SHA1 hash: 4849547484eb2f77af52feafb67a4e3650b70e3d
MD5 hash: 80696c6f76a68641d986e33b535ada57
humanhash: lithium-fillet-pennsylvania-winner
File name:bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3.bin
Download: download sample
Signature RedXOR
Create hunting rule
File size:45'056 bytes
First seen:2021-05-24 00:23:37 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:KPb1J4A0bzQZ1Q0B50/FNu+W9b4ERfHeQ:KPx/Wzf06FNw4ERfH
TLSH 6013930FBA12D9B9C046F2704EDBC5F9A4B17CF5AF22601B3245772F9A70B24072D669
Reporter Arkbird_SOLG
Tags:apt RedXOR Winnti

Intelligence

File Origin
# of uploads :
1
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Redxor-9844791-0
Create hunting rule

Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not-packed
Botnet:
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Full report:
https://elfdigest.com/brief/bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3
Result
Verdict:
MALICIOUS
Malware family:
RedXOR
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bf12b63b-b029-4388-9202-c710b937504d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3/
Threat name:
Linux.Backdoor.Redxor
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 04:17:30 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/210524-xl3b1p5ffn/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments