MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148
SHA3-384 hash: 5350a6822ed3005f397acd0ee0fe58f7c405eaff348b40fd06c8d9d7320e52646abcd7ea9a63d9228ac330612003f3e2
SHA1 hash: 85fda1be0fd4d3b1067d8f78849ac04452ba4a26
MD5 hash: 98100986eb1e293ea0270a96bd5b4fb7
humanhash: indigo-blossom-island-mexico
File name:aarch64
Download: download sample
File size:509'896 bytes
First seen:2025-06-05 17:12:17 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH T102B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9163.12598.5881.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6841d0e807b5e8c1cfe4f5fclinux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creates directories
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
exploit gcc lolbin remote
Link:
https://www.filescan.io/uploads/6841d032171e01f959374b42/reports/38abdd4a-ac5d-497e-ba96-a3ff714a84fa/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
false
Architecture:
arm
Packer:
custom
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
41303
Full report:
https://elfdigest.com/brief/c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 87.227.32.92:6881
type: 45.154.86.83:6881
type: 119.198.73.147:6881
type: 73.162.2.9:6881
type: 86.149.213.169:6881
type: 90.8.228.8:6881
type: 112.152.125.107:6881
type: 5.181.50.33:6881
type: 82.62.197.138:6881
type: 86.100.129.119:6881
type: 23.227.209.117:6881
type: 94.242.41.188:6881
type: 84.226.18.229:6881
type: 74.45.175.112:6881
type: 47.186.2.102:6881
type: 101.204.204.4:6881
type: 94.158.2.184:6881
type: 75.159.212.124:6881
type: 35.167.186.212:6881
type: 167.99.72.189:6881
type: 144.217.72.98:6881
type: 74.48.140.189:6881
type: 69.164.207.171:6881
type: 192.227.221.84:6881
type: 23.95.192.22:6881
type: 107.173.127.249:6881
type: 5.140.160.76:6881
type: 13.58.27.33:6881
type: 103.249.204.14:6881
type: 47.227.133.77:6881
type: 199.7.146.86:6881
type: 18.221.7.72:6881
type: 88.213.216.25:6881
type: 54.214.62.55:6881
type: 75.119.138.164:6881
type: 92.99.187.2:6881
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 178.162.173.91:28003
type: 178.162.173.32:28003
type: 178.162.173.48:28003
type: 195.154.233.74:6880
type: 173.230.130.111:6880
type: 130.239.18.158:8580
type: 130.239.18.158:8508
type: 81.171.22.205:28013
type: 178.162.174.70:28013
type: 130.239.18.158:8539
type: 77.37.132.206:5222
type: 178.162.174.168:28012
type: 178.162.173.147:28007
type: 178.162.174.101:28007
type: 151.80.44.142:51413
type: 188.165.209.153:51413
type: 89.179.245.6:51413
type: 5.39.95.41:51413
type: 176.74.129.196:51413
type: 77.236.206.189:51413
type: 5.196.74.119:51413
type: 161.35.157.95:51413
type: 207.154.212.101:51413
type: 46.232.211.130:16609
type: 178.162.173.149:28004
type: 81.171.6.41:28004
type: 65.21.34.43:50000
type: 37.27.120.58:50000
type: 37.27.104.56:50000
type: 65.21.125.170:50000
type: 135.181.238.113:50000
type: 65.108.43.34:50000
type: 158.101.23.102:8999
type: 185.203.56.49:17129
type: 46.232.211.190:13709
type: 130.239.18.158:8531
type: 51.210.179.31:49048
type: 37.48.116.206:55201
type: 188.244.36.119:51050
type: 222.121.123.234:33134
type: 81.226.201.46:13509
type: 89.149.202.3:28028
type: 178.162.173.205:28015
type: 150.249.154.214:22123
type: 185.203.56.25:24633
type: 168.119.65.34:32283
type: 178.162.174.211:28000
type: 47.86.167.191:40696
type: 202.125.43.76:57857
type: 89.149.217.144:22686
type: 46.232.210.50:20409
type: 51.159.104.68:7606
type: 126.91.62.244:24809
type: 107.189.14.229:25122
type: 89.149.226.26:54385
type: 185.162.184.8:22767
type: 178.162.173.215:28008
type: 88.132.125.214:15791
type: 94.255.152.22:36896
type: 129.213.88.72:23371
type: 176.208.56.65:1073
type: 124.6.29.208:28367
type: 68.194.5.67:55917
type: 14.50.22.79:8034
type: 116.39.25.87:32977
type: 95.54.10.144:13012
type: 212.220.230.58:1205
type: 148.71.134.47:1027
type: 111.217.34.105:28050
type: 159.223.200.138:31782
type: 188.163.70.241:9120
type: 67.60.192.136:6889
type: 87.62.99.74:6889
type: 94.181.6.50:20538
type: 2.223.208.67:34452
type: 191.126.134.145:59843
type: 95.105.127.32:22077
type: 144.24.95.120:45895
type: 192.99.7.29:58494
type: 82.30.17.27:11248
type: 185.30.41.122:9660
type: 106.205.173.147:29936
type: 46.150.82.254:6729
type: 94.255.131.216:1108
type: 94.99.174.43:54651
type: 46.164.216.178:4096
type: 46.232.211.180:51539
type: 94.141.126.208:5891
type: 2.94.64.91:40161
type: 54.194.137.170:6882
type: 37.113.147.126:6882
type: 89.23.195.185:6882
type: 188.165.201.120:6882
type: 35.171.49.86:6892
type: 49.12.86.202:6883
type: 45.65.156.253:62417
type: 112.168.102.77:39185
type: 54.77.218.23:6992
type: 35.171.49.86:6992
type: 5.17.27.130:45007
type: 105.100.114.59:17114
type: 176.118.70.223:52522
type: 81.171.17.53:53260
type: 5.39.85.82:56862
type: 221.153.222.168:33284
type: 152.53.45.107:7292
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 146.59.3.81:10240
type: 152.53.104.128:10240
type: 46.164.218.81:4920
type: 54.39.52.64:54510
type: 75.164.249.13:51415
type: 54.39.52.64:48853
type: 79.147.27.54:17881
type: 5.255.45.69:44599
type: 46.232.210.10:12459
type: 39.111.248.108:65421
type: 114.79.39.223:40941
type: 114.79.38.27:40941
type: 75.238.127.41:59277
type: 183.101.128.68:41150
type: 66.70.178.54:49863
type: 179.190.125.202:32055
type: 187.43.161.222:3584
type: 5.18.90.51:1753
type: 82.1.195.150:15469
type: 8.219.235.82:31564
type: 213.227.153.16:28009
type: 178.162.173.225:28005
type: 188.165.195.203:56140
type: 188.165.231.77:50612
type: 90.27.107.46:28847
type: 46.161.40.74:38507
type: 71.209.102.68:54463
type: 62.197.98.249:39504
type: 95.26.145.104:57540
type: 185.203.56.59:23905
type: 121.143.91.161:7879
type: 95.90.233.152:7987
type: 91.197.22.179:38056
type: 91.132.211.21:37950
type: 95.26.60.38:1994
type: 187.255.98.209:12213
type: 91.184.240.79:34233
type: 98.45.178.74:17805
type: 125.135.131.185:60707
type: 61.77.57.114:7752
type: 187.3.139.228:48288
type: 82.8.85.128:27162
type: 124.18.188.71:41113
type: 49.230.4.252:43040
type: 95.32.2.43:2572
type: 152.53.45.107:6983
type: 187.136.168.17:28675
type: 178.162.174.239:28001
type: 195.154.172.179:23450
type: 45.87.251.149:28180
type: 188.68.139.143:18974
type: 78.67.23.47:51753
type: 178.34.150.79:29210
type: 185.183.34.95:6886
type: 176.98.71.160:48215
type: 88.149.82.61:22872
type: 75.183.211.110:63123
type: 220.125.233.194:8068
type: 62.235.50.39:42708
type: 88.119.64.146:46512
type: 149.56.27.121:39821
type: 94.158.32.154:34442
type: 85.87.221.194:38981
type: 201.238.125.68:50321
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7cc17770-4c63-4b5d-95cf-e8ebb8a7a6d1
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1707503
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1707503 Sample: aarch64.elf Startdate: 05/06/2025 Architecture: LINUX Score: 68 38 160.20.201.108, 22572 bipNETInternetBandaLargaBR Brazil 2->38 40 103.150.8.161, 50476, 6881 XTOM-AS-JPxTomJP unknown 2->40 42 101 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Connects to many ports of the same IP (likely port scanning) 2->46 10 aarch64.elf 2->10         started        signatures3 process4 process5 12 aarch64.elf sh 10->12         started        14 aarch64.elf 10->14         started        17 aarch64.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        54 Opens /sys/class/net/* files useful for querying network interface information 14->54 56 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->56 25 aarch64.elf 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.RmmcSg, ASCII 19->36 dropped 48 Sample tries to persist itself using cron 19->48 50 Executes the "crontab" command typically for achieving persistence 19->50 29 sh crontab 23->29         started        32 aarch64.elf 25->32         started        signatures9 process10 signatures11 52 Executes the "crontab" command typically for achieving persistence 29->52 34 aarch64.elf 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148/
Threat name:
Linux.Dropper.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-05 17:13:12 UTC
File Type:
ELF64 Little (Exe)
AV detection:
14 of 38 (36.84%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjayyvnhtzqwmgh5tbfwftbwxe5zyzw7wu77gafxxpqbarx3qfea._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/250605-vrhcfaer4y/
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/10284e9d-0ce2-4c23-a2bb-df5d0e0e017a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf c2418c55a79e616618fd984b62cc36b93b9c66dfb53ff300b7bbe01046fb8148

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3558221/
  
Delivery method
Distributed via web download

Comments