MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50
SHA3-384 hash:	0004349d4bca02563919dfe4bc92bbcdb3decf9693767ecbd341f4e78d9937acc7a6e8fa0c0ad3e70f998659349e64af
SHA1 hash:	cc5bf5fd173a6eed3528546f4931b3eb440a5d82
MD5 hash:	8186cb4877bae4e76714704c98166253
humanhash:	blue-romeo-monkey-river
File name:	aarch64
Download:	download sample
File size:	509'896 bytes
First seen:	2025-07-13 11:37:53 UTC
Last seen:	2025-07-13 23:57:57 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH	T1B0B41228EE4E38D1F3D1E378DA0A4BB1B05B79D0C166C1B2BA41E25D95EDEDEC5D0212
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68739aa9c9eb97473768ac5flinux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc rust

Link:

https://www.filescan.io/uploads/68739aac425a30d7acd88e09/reports/7b77b630-3ea8-4180-afe3-3ce711701b2a/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 188.42.55.92:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 159.69.207.23:6881
type: 112.82.200.225:6881
type: 92.255.189.73:6881
type: 31.170.175.80:6881
type: 85.193.135.155:6881
type: 185.229.160.136:6881
type: 151.177.151.23:6881
type: 178.45.152.133:6881
type: 128.76.137.146:6881
type: 66.51.166.4:6881
type: 119.246.29.206:6881
type: 61.22.193.216:6881
type: 86.87.242.243:6881
type: 194.149.134.25:6881
type: 101.235.214.231:6881
type: 146.115.136.213:6881
type: 107.181.234.235:6881
type: 109.14.8.16:6881
type: 179.245.171.131:6881
type: 192.227.221.84:6881
type: 91.199.149.77:6881
type: 18.191.2.28:6881
type: 142.171.58.199:6881
type: 185.84.41.76:6881
type: 89.165.219.117:6881
type: 74.48.140.189:6881
type: 142.171.125.191:6881
type: 18.188.31.0:6881
type: 178.64.55.109:6881
type: 86.38.200.129:6881
type: 167.99.72.189:6881
type: 75.119.138.164:6881
type: 130.239.18.158:8539
type: 178.162.174.178:28003
type: 178.162.173.147:28003
type: 173.230.130.111:6880
type: 69.164.203.179:6880
type: 45.203.154.72:6880
type: 195.154.233.74:6880
type: 95.168.162.161:42670
type: 178.162.173.231:28001
type: 95.211.216.167:28002
type: 5.79.93.242:61920
type: 139.162.171.161:51413
type: 213.231.5.66:51413
type: 62.210.181.16:51413
type: 165.227.234.239:51413
type: 37.59.39.208:51413
type: 14.1.38.18:51413
type: 51.195.235.94:51413
type: 148.135.109.208:51413
type: 37.187.18.28:51413
type: 185.158.114.210:51413
type: 87.205.7.81:51413
type: 81.110.245.29:51413
type: 5.189.153.225:51413
type: 151.80.199.52:51413
type: 81.197.95.26:51413
type: 209.234.248.193:51413
type: 178.162.173.38:28015
type: 213.227.152.137:28015
type: 46.232.211.170:22909
type: 51.38.81.200:8657
type: 185.203.56.50:59141
type: 130.239.18.158:8597
type: 31.209.55.64:6248
type: 72.21.17.39:11466
type: 185.21.216.160:57286
type: 178.162.174.236:28005
type: 178.162.173.89:28005
type: 37.48.70.3:28000
type: 45.87.251.132:28008
type: 185.203.56.39:18644
type: 178.162.173.164:28007
type: 49.159.6.155:10446
type: 169.150.219.153:18059
type: 69.50.95.40:10005
type: 185.177.124.176:6890
type: 46.232.211.240:20959
type: 37.120.210.219:19256
type: 133.114.69.186:16021
type: 81.111.118.156:49001
type: 192.249.187.80:49001
type: 152.89.133.44:49001
type: 194.24.237.213:13718
type: 185.21.217.56:54442
type: 178.162.174.194:28009
type: 142.120.87.107:6882
type: 54.194.137.170:6882
type: 95.211.224.140:28004
type: 178.162.174.85:28004
type: 186.189.73.23:15788
type: 189.183.44.44:44843
type: 203.222.25.130:18283
type: 187.39.84.104:60368
type: 46.121.238.21:6889
type: 143.177.198.111:6889
type: 51.174.189.42:6889
type: 95.251.215.35:6889
type: 182.176.164.246:41904
type: 94.63.147.81:14759
type: 218.102.130.50:13903
type: 125.132.15.82:40674
type: 45.136.230.103:50171
type: 173.177.149.90:64052
type: 5.39.80.127:34611
type: 81.171.6.43:28014
type: 119.194.239.206:32587
type: 60.65.165.1:12387
type: 65.21.76.209:8999
type: 90.251.94.78:8999
type: 61.93.137.188:16310
type: 188.250.30.170:60974
type: 146.70.98.182:42175
type: 73.249.165.228:42423
type: 72.21.17.103:63502
type: 222.153.170.64:37850
type: 54.194.135.233:6892
type: 18.196.86.103:6892
type: 97.180.105.204:59903
type: 185.203.56.53:14734
type: 178.162.174.221:28013
type: 121.184.224.66:32881
type: 216.39.249.244:61720
type: 31.215.104.24:32415
type: 109.130.231.0:56616
type: 87.219.129.45:35326
type: 101.140.248.154:26346
type: 139.47.14.56:6500
type: 188.119.27.159:41878
type: 97.127.75.147:44751
type: 37.27.113.233:55344
type: 93.159.13.182:4608
type: 93.40.93.203:61543
type: 43.134.18.13:6001
type: 47.89.251.173:8887
type: 186.108.241.219:45152
type: 146.212.69.154:36878
type: 176.113.74.130:29572
type: 176.113.74.130:9052
type: 103.241.61.195:8148
type: 109.151.69.20:23302
type: 176.113.74.130:26970
type: 45.172.70.154:5066
type: 152.53.45.107:7335
type: 37.187.151.6:17322
type: 208.87.240.21:11162
type: 152.53.52.107:10240
type: 213.159.77.154:11158
type: 13.114.205.93:6992
type: 59.14.49.220:56127
type: 95.216.116.106:16113
type: 84.215.12.194:42195
type: 111.241.61.115:8371
type: 176.113.74.130:21256
type: 5.163.134.53:23105
type: 181.41.103.7:12818
type: 78.25.4.105:23923
type: 38.25.4.105:34010
type: 23.95.11.50:65524
type: 78.142.231.133:6767
type: 175.210.211.137:33142
type: 175.200.214.33:33231
type: 182.161.222.146:1024
type: 95.214.53.172:1688
type: 221.155.23.96:33251
type: 185.203.56.72:12895
type: 220.87.248.86:41247
type: 89.64.92.87:41205
type: 107.173.149.140:6339

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/01a9b555-72b6-4b52-aeba-6536cb91aeec

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/56a0c9cd-e638-438a-9f2f-3caa4ba60103

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-07-13 11:38:20 UTC

File Type:

ELF64 Little (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3mnmktg5h3lgkhgbbdpjjumznofedm6ih2wtzdwbv4rj27a2lzia._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250713-nrvjfabr8y/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/af2c5d95-1710-4951-89cf-101610b5a6d8

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf db1ac54cdd3ed6651cc108de94d1996b8a41b3c83ead3c8ec1af229d7c1a5e50

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558161/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample