MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c
SHA3-384 hash:	122f84ce721763b0b1edc8296460aa03c497a0592714220a5521e0461d4429f5a510c100e25437e279ffce22264bd725
SHA1 hash:	9af74a7340222d36d393f310666e573612683667
MD5 hash:	b19c919fd65bb8ae9b5db7fad3a4529e
humanhash:	diet-may-ceiling-fillet
File name:	aarch64
Download:	download sample
File size:	509'896 bytes
First seen:	2025-06-20 11:12:38 UTC
Last seen:	2025-06-21 07:24:59 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH	T1A4B41228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68554265e08881bb831b15f8linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/6855426a66c4b5c0b99b7d6b/reports/01c688d1-ce1f-49d2-a2e0-089c93d991ba/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

52700

Full report:

https://elfdigest.com/brief/d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 79.148.92.59:6881
type: 112.173.3.91:6881
type: 95.66.217.20:6881
type: 63.247.211.162:6881
type: 81.110.151.48:6881
type: 182.229.224.56:6881
type: 73.152.99.187:6881
type: 37.9.150.187:6881
type: 81.240.35.217:6881
type: 91.225.20.2:6881
type: 88.180.245.193:6881
type: 88.173.134.197:6881
type: 54.194.137.170:6881
type: 67.84.80.74:6881
type: 31.134.26.6:6881
type: 104.195.12.42:6881
type: 51.15.20.12:6881
type: 82.204.204.22:6881
type: 74.121.140.39:6881
type: 54.214.62.31:6881
type: 13.58.27.33:6881
type: 18.218.241.3:6881
type: 192.227.221.84:6881
type: 116.15.85.107:6881
type: 141.98.154.145:6881
type: 62.169.27.65:6881
type: 114.200.66.56:6881
type: 35.163.251.58:6881
type: 144.217.72.98:6881
type: 41.157.188.109:6881
type: 66.183.41.39:6881
type: 85.15.107.13:6881
type: 217.103.187.226:6881
type: 213.157.43.139:6881
type: 188.62.132.213:6881
type: 18.220.82.190:6881
type: 54.70.174.84:6881
type: 49.36.97.253:6881
type: 178.162.174.43:28004
type: 178.162.174.58:28004
type: 178.162.174.138:28004
type: 130.239.18.158:8524
type: 135.181.238.57:50000
type: 135.181.227.244:50000
type: 37.27.117.117:50000
type: 37.27.117.249:50000
type: 65.21.129.56:50000
type: 135.181.223.104:50000
type: 37.27.117.252:50000
type: 78.46.89.70:50000
type: 195.201.153.69:50000
type: 65.21.128.241:50000
type: 65.21.129.61:50000
type: 37.27.119.249:50000
type: 37.27.117.48:50000
type: 65.21.193.56:50000
type: 65.21.125.159:50000
type: 65.21.128.250:50000
type: 65.21.128.219:50000
type: 178.162.174.222:28014
type: 178.162.174.77:28014
type: 130.239.18.158:8515
type: 130.239.18.158:8513
type: 89.149.202.13:28035
type: 178.162.174.5:28005
type: 178.162.173.221:28005
type: 5.79.122.78:28003
type: 178.162.174.242:28003
type: 195.201.179.130:16309
type: 185.132.178.224:6886
type: 195.154.185.217:27143
type: 3.141.159.213:6880
type: 18.117.46.179:6880
type: 18.217.35.30:6880
type: 185.149.91.133:20018
type: 178.162.174.46:28013
type: 178.162.174.101:28013
type: 54.211.14.111:20871
type: 201.235.220.69:23936
type: 5.39.94.219:45467
type: 175.215.248.209:41119
type: 70.27.96.90:51413
type: 151.80.42.34:51413
type: 37.139.1.125:51413
type: 178.128.174.141:51413
type: 95.107.230.73:51413
type: 89.179.246.163:51413
type: 77.172.131.63:51413
type: 95.31.9.189:51413
type: 97.85.232.152:51413
type: 89.76.24.105:51413
type: 76.136.208.255:51413
type: 87.147.254.122:51413
type: 193.0.61.50:51413
type: 178.162.173.198:28007
type: 103.100.225.184:49001
type: 176.62.104.220:49001
type: 95.221.247.11:49001
type: 68.179.177.133:49001
type: 176.197.190.66:49001
type: 119.64.31.161:7996
type: 222.103.139.234:32954
type: 105.186.80.7:24021
type: 185.203.56.28:23376
type: 183.78.86.62:60474
type: 121.159.128.148:32675
type: 107.189.28.65:15079
type: 121.186.221.151:32852
type: 185.203.56.50:59110
type: 5.79.66.11:54337
type: 141.95.53.34:8648
type: 213.232.235.11:8999
type: 139.28.218.235:20921
type: 95.211.247.101:28009
type: 178.162.174.111:28009
type: 24.66.168.150:44684
type: 41.71.48.111:21537
type: 209.121.110.55:26035
type: 95.211.19.97:3766
type: 104.37.170.150:59412
type: 195.154.171.176:33182
type: 73.59.56.74:13243
type: 83.204.159.134:26193
type: 91.113.180.150:6889
type: 50.93.251.101:6889
type: 37.119.182.54:6889
type: 84.120.237.137:6889
type: 102.66.149.54:9841
type: 5.135.156.163:56843
type: 73.211.146.137:33667
type: 51.159.104.59:7227
type: 31.135.153.133:17620
type: 185.21.217.49:55707
type: 175.198.71.52:42205
type: 83.138.49.208:63607
type: 73.41.71.142:26085
type: 107.179.192.55:28073
type: 173.93.114.161:52926
type: 137.74.95.127:54595
type: 172.103.161.42:50739
type: 176.29.155.225:2679
type: 144.76.175.153:56338
type: 5.248.110.181:58315
type: 123.255.47.39:18283
type: 185.21.216.153:60249
type: 51.159.104.85:8469
type: 176.10.0.129:20693
type: 94.23.21.8:59430
type: 113.211.211.59:48025
type: 188.163.114.189:28265
type: 112.120.23.186:57274
type: 54.77.218.23:6992
type: 5.107.231.122:40730
type: 195.154.172.179:28074
type: 160.20.87.109:2839
type: 46.246.8.8:26357
type: 84.43.254.237:27405
type: 208.87.240.21:11158
type: 152.53.52.107:10240
type: 194.29.101.83:10240
type: 54.39.52.64:39450
type: 152.165.67.193:24235
type: 50.47.91.242:57325
type: 78.22.194.103:39844
type: 45.62.79.179:21953
type: 37.27.113.233:26378
type: 111.94.211.239:20445
type: 35.171.49.86:6892
type: 177.104.21.56:17675
type: 152.53.45.107:7039
type: 45.137.83.199:50171
type: 47.89.251.173:9999
type: 81.171.17.33:41920
type: 84.15.219.253:5646
type: 188.165.241.169:56121
type: 178.162.173.163:28006
type: 179.5.68.209:32465
type: 109.245.65.39:6893
type: 169.150.223.223:13409
type: 162.157.217.149:51679
type: 83.137.204.129:14082
type: 37.27.113.233:56919
type: 93.51.37.70:19091
type: 89.149.202.3:28015
type: 37.48.70.4:28010
type: 175.210.133.124:54083
type: 37.228.200.183:5730
type: 77.220.196.183:15998
type: 86.49.239.113:5224
type: 94.8.16.63:6899
type: 210.178.108.209:40964
type: 186.77.132.61:29422
type: 221.71.251.228:58436

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/14a8bc44-7020-4eeb-9a22-6a6c3be8183a

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/71e65a2c-7027-45ea-af4f-55efc93dd610

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-20 11:13:32 UTC

File Type:

ELF64 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3asikcy2n6zim4hswndbgi6ha5mvd43qq7zn4bbppt3qjpb6jiwa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250620-nbl75agk8y/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2ecc5133-f661-4027-968b-357c2f474942

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.96

Link:

https://yomi.yoroi.company/submissions/d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf d824850b1a6fb28670f2b3461323c7075951f37087f2de042f7cf704bc3e4a2c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558161/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample