MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4
SHA3-384 hash:	1128230253e154b2874f55634f015ae8ebaee51321e72f269d62aa28d1784efbbdd50cc24b9882b3c35e68dfb48078e6
SHA1 hash:	07e7aae3257249445ded13e50362bbd30e8c0b2b
MD5 hash:	5ea0ff41e234e0946cd07c3e7583268a
humanhash:	solar-speaker-alaska-bulldog
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-07-02 16:26:00 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T19EA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E400
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68655e72900df8e7f8658de5

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creates directories

Changes access rights for a written file

Locks files

Changes the time when the file was created, accessed, or modified

Creating a process from a recently created file

Collects information on the CPU

Receives data from a server

Creating a file

Runs as daemon

Creating a file in the %temp% directory

Opens a port

Launching a process

Sends data to a server

Connection attempt

Creates or modifies files in /cron to set up autorun

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 176.110.250.22:6881
type: 213.88.12.218:6881
type: 88.85.202.75:6881
type: 176.205.97.55:6881
type: 220.135.240.159:6881
type: 192.166.138.5:6881
type: 46.189.195.95:6881
type: 217.215.30.202:6881
type: 31.181.88.148:6881
type: 93.176.180.96:6881
type: 99.121.250.216:6881
type: 37.232.230.94:6881
type: 5.79.67.10:6881
type: 37.48.108.218:6881
type: 5.135.183.63:6881
type: 77.170.83.63:6881
type: 112.170.65.96:6881
type: 80.192.142.6:6881
type: 95.182.236.186:6881
type: 106.51.104.30:6881
type: 147.148.48.250:6881
type: 178.87.220.19:6881
type: 218.147.248.114:6881
type: 212.77.149.53:6881
type: 109.184.55.113:6881
type: 18.218.241.3:6881
type: 54.70.174.84:6881
type: 54.214.62.55:6881
type: 142.171.58.199:6881
type: 189.186.102.111:6881
type: 35.167.186.212:6881
type: 176.50.36.183:6881
type: 86.169.205.56:6881
type: 85.206.90.225:6881
type: 24.201.163.231:6881
type: 89.212.106.69:6881
type: 82.112.187.60:6881
type: 58.152.223.222:6881
type: 63.143.118.227:6881
type: 130.239.18.158:8516
type: 69.164.203.179:6880
type: 195.154.233.74:6880
type: 45.203.206.54:6880
type: 54.144.88.168:6880
type: 185.196.61.129:6880
type: 18.188.239.31:6880
type: 3.130.60.88:6880
type: 154.202.133.136:6880
type: 45.203.154.77:6880
type: 3.16.242.66:6880
type: 52.15.134.118:6880
type: 23.21.21.47:6880
type: 130.239.18.158:8580
type: 178.162.173.166:28000
type: 178.162.173.91:28003
type: 178.162.173.32:28003
type: 178.162.173.73:28003
type: 178.162.174.99:28003
type: 178.162.173.105:28003
type: 94.75.194.118:28003
type: 37.27.117.181:50000
type: 65.21.125.170:50000
type: 37.27.119.126:50000
type: 37.27.120.47:50000
type: 37.27.119.251:50000
type: 37.27.119.250:50000
type: 37.27.103.179:50000
type: 37.27.117.119:50000
type: 135.181.238.62:50000
type: 37.27.119.178:50000
type: 65.21.34.43:50000
type: 217.23.1.103:6887
type: 130.239.18.158:8526
type: 178.162.173.102:28007
type: 212.7.202.40:28007
type: 5.39.85.86:56038
type: 130.239.18.158:8510
type: 95.211.81.248:43838
type: 81.171.20.69:62255
type: 137.184.125.217:8000
type: 43.133.45.199:50351
type: 185.21.216.198:49651
type: 178.162.174.147:28012
type: 178.162.174.168:28012
type: 178.162.174.11:28012
type: 178.162.173.169:28012
type: 81.171.17.98:49825
type: 185.162.184.37:50405
type: 45.87.251.164:13151
type: 209.17.171.189:51413
type: 104.244.73.2:51413
type: 178.124.154.112:51413
type: 109.219.41.67:51413
type: 96.48.228.146:51413
type: 37.187.124.55:51413
type: 46.17.102.90:51413
type: 112.205.145.66:51413
type: 107.219.134.81:51413
type: 213.144.130.42:51413
type: 212.3.132.87:51413
type: 95.246.21.24:51413
type: 185.68.6.62:51413
type: 89.45.12.133:51413
type: 188.175.168.20:51413
type: 103.127.136.120:51413
type: 162.253.61.13:51413
type: 79.116.202.106:51413
type: 90.46.79.31:51413
type: 113.235.4.192:51413
type: 90.189.164.94:51413
type: 80.203.14.245:51413
type: 185.90.100.42:51413
type: 46.232.210.23:64056
type: 37.48.89.200:65022
type: 95.211.208.172:55931
type: 178.162.174.163:28002
type: 178.162.174.2:28002
type: 178.162.173.169:28001
type: 178.162.174.170:28001
type: 81.171.6.41:28001
type: 83.149.98.183:28001
type: 46.232.211.180:51539
type: 178.162.174.88:28014
type: 178.162.173.231:28014
type: 178.162.174.56:28014
type: 178.162.173.149:28004
type: 178.162.173.138:28004
type: 178.162.174.173:28004
type: 178.162.173.204:28004
type: 185.21.217.21:51378
type: 185.203.56.55:12337
type: 89.149.202.17:28034
type: 5.79.98.151:59939
type: 43.133.45.199:50021
type: 89.149.202.106:50193
type: 195.154.176.26:8674
type: 178.162.144.51:21183
type: 178.162.173.154:28008
type: 93.175.200.146:63569
type: 69.50.95.40:12033
type: 185.149.91.149:51007
type: 185.149.91.185:51007
type: 176.63.14.49:12411
type: 178.162.173.97:28013
type: 89.149.202.13:28013
type: 147.12.32.70:6889
type: 92.198.21.34:6889
type: 49.251.170.140:6889
type: 118.38.170.52:6889
type: 185.203.56.27:4881
type: 92.238.241.118:23312
type: 178.162.173.221:28005
type: 59.138.192.156:24113
type: 51.75.68.29:8664
type: 185.149.91.147:51112
type: 158.69.27.241:43789
type: 62.212.81.233:28009
type: 178.162.174.110:28009
type: 130.239.18.158:8513
type: 95.154.25.252:31339
type: 185.215.226.31:54127
type: 46.232.211.160:21009
type: 73.34.77.186:14082
type: 185.148.3.118:63360
type: 116.241.200.153:61943
type: 185.21.216.133:49315
type: 185.203.56.28:15644
type: 209.127.101.124:14345
type: 195.154.172.179:25428
type: 212.7.211.46:28128
type: 196.210.82.92:36910
type: 46.232.211.80:64110
type: 14.46.16.201:32687
type: 112.71.52.7:44540
type: 71.84.60.243:6882
type: 78.82.51.147:47171
type: 72.183.243.61:2260
type: 82.34.245.182:39904
type: 84.229.180.36:55861
type: 223.187.15.62:63345
type: 27.63.54.227:48622
type: 191.223.246.227:38122
type: 189.61.151.232:38093
type: 136.27.8.98:5778
type: 195.154.178.158:8646
type: 78.166.238.231:38754
type: 24.2.53.207:52882
type: 50.42.73.149:20129
type: 88.231.58.174:34871
type: 188.165.244.171:50694
type: 188.165.246.140:51353
type: 54.209.131.199:6892
type: 87.96.162.24:22444
type: 144.76.175.153:57028
type: 72.21.17.92:63155
type: 152.53.104.128:10240
type: 81.202.73.60:22922
type: 137.74.95.127:27058
type: 54.39.52.64:54510
type: 130.204.150.33:20482
type: 222.102.172.234:40972
type: 69.50.95.40:10031
type: 46.246.3.204:38269
type: 45.83.228.196:8999
type: 185.148.3.118:8999
type: 24.46.12.182:43345
type: 62.210.201.217:8645
type: 169.150.223.227:64145
type: 222.114.9.136:41324
type: 176.147.106.143:57260
type: 141.98.102.243:33222
type: 50.46.34.102:30020
type: 95.155.45.178:46285
type: 41.107.62.190:49708
type: 213.10.157.164:7881
type: 185.203.56.59:12866
type: 23.225.198.210:13963
type: 76.90.52.185:12664
type: 189.194.189.125:38134
type: 69.160.115.247:45779
type: 190.104.191.39:14238

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4b8f2c5a-7d68-477b-a212-ce0de739b4b2

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f6e1d736-dd1d-4c29-b43d-15cb1b537e46

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-07-02 16:26:24 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3hb2vo2ml25wzgsve6yn72v3a72s2ui5lbblwnx2rjlhn3lroosa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250702-txj8jszjv5/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a98445ed-76be-4baa-92e6-0f80da80db58

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf d9c3aabb4c5ebb6c9a5527b0dfeabb07f52d511d5842bb36fa8a5676ed7173a4

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558169/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample