MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7
SHA3-384 hash:	7282388ce3883a0e6e82684b8f0f3154e2ca3e02cd2dab929b646415ab8c7fc52fe8e3324a513dee04f1075c47e6bac6
SHA1 hash:	0f0c7240e8394f5db2a7b129ccbd626aedc12e97
MD5 hash:	91ddda3f1cafa51a1f66eb1e4a380411
humanhash:	fruit-berlin-three-grey
File name:	i686
Download:	download sample
File size:	587'764 bytes
First seen:	2025-06-08 03:07:12 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH	T1BFC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Siggen.9095.24890.31368.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6845001e8bd5d68a12e6adealinux22vpnfull_triage

Tags:

shellcode

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process from a recently created file

Connection attempt

Launching a process

Locks files

DNS request

Runs as daemon

Creating a file

Creates directories

Creating a file in the %temp% directory

Changes access rights for a written file

Receives data from a server

Opens a port

Sends data to a server

Changes the time when the file was created, accessed, or modified

Collects information on the CPU

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/6844fe6ffd02ed5e059dbd7d/reports/86e93f4c-afdb-453e-91e2-1a55762d6434/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 188.187.99.27:6881
type: 91.7.65.99:6881
type: 88.151.91.31:6881
type: 173.89.209.75:6881
type: 23.88.96.103:6881
type: 76.71.113.15:6881
type: 5.135.165.160:6881
type: 195.43.182.105:6881
type: 176.221.6.220:6881
type: 178.183.166.202:6881
type: 91.222.155.239:6881
type: 95.66.217.20:6881
type: 168.70.106.130:6881
type: 217.112.15.47:6881
type: 134.209.183.166:6881
type: 178.69.209.93:6881
type: 84.123.118.248:6881
type: 113.78.253.183:6881
type: 88.214.24.18:6881
type: 159.69.181.168:6881
type: 94.198.237.74:6881
type: 86.245.233.10:6881
type: 5.228.33.139:6881
type: 172.3.107.27:6881
type: 181.88.219.18:6881
type: 18.218.241.3:6881
type: 195.49.187.26:6881
type: 218.250.18.87:6881
type: 152.110.67.78:6881
type: 46.10.54.35:6881
type: 204.12.208.37:6881
type: 35.163.251.58:6881
type: 152.59.32.137:6881
type: 202.128.113.216:6881
type: 13.58.27.33:6881
type: 54.194.124.68:6881
type: 198.176.113.216:6881
type: 54.214.62.31:6881
type: 84.66.204.77:6881
type: 176.215.97.50:6881
type: 109.219.210.221:6881
type: 78.63.23.7:6881
type: 78.139.85.18:6881
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 213.158.1.85:51413
type: 5.227.31.125:51413
type: 171.213.223.192:51413
type: 112.85.137.109:51413
type: 93.51.18.111:51413
type: 91.121.222.114:51413
type: 5.135.163.217:51413
type: 5.135.155.133:51413
type: 37.187.20.193:51413
type: 138.199.27.226:51413
type: 2.218.55.167:51413
type: 95.70.151.221:51413
type: 110.84.122.138:51413
type: 161.97.144.253:51413
type: 195.154.252.60:51413
type: 39.124.13.53:51413
type: 3.12.65.135:6880
type: 45.203.208.35:6880
type: 3.141.159.213:6880
type: 148.153.170.2:6880
type: 54.208.218.201:6880
type: 44.222.38.15:6880
type: 3.18.11.235:6880
type: 45.149.235.223:26159
type: 178.162.174.43:28004
type: 178.162.174.227:28004
type: 178.162.174.222:28014
type: 178.162.174.46:28014
type: 178.162.174.163:28014
type: 162.251.63.120:10015
type: 51.159.104.76:7186
type: 178.33.233.79:8999
type: 213.232.235.11:8999
type: 87.229.51.107:8999
type: 223.109.212.194:6889
type: 90.66.177.251:6889
type: 42.200.197.153:6889
type: 95.70.152.34:22685
type: 60.248.165.91:23348
type: 178.162.173.163:28006
type: 162.251.63.78:12074
type: 217.121.231.94:59625
type: 220.79.54.239:40785
type: 216.39.248.235:3978
type: 46.151.155.34:1139
type: 13.221.89.204:49180
type: 178.162.174.185:28000
type: 45.87.251.10:51340
type: 185.149.91.179:20025
type: 142.202.48.88:14022
type: 51.250.34.198:25036
type: 5.79.98.185:21737
type: 216.39.248.235:3943
type: 122.192.133.173:6885
type: 185.183.35.103:6885
type: 213.227.151.25:28008
type: 94.31.247.167:61518
type: 189.5.173.202:52360
type: 142.202.48.88:12076
type: 62.217.190.135:50011
type: 31.50.70.195:51515
type: 69.50.95.40:10060
type: 94.21.177.159:5893
type: 185.149.91.21:51118
type: 5.79.66.11:54337
type: 95.211.247.101:28009
type: 178.162.173.172:28009
type: 141.95.53.34:8648
type: 5.135.156.163:56843
type: 213.91.248.112:34667
type: 45.87.251.10:42440
type: 70.27.251.118:9010
type: 73.183.19.73:9010
type: 142.202.48.88:12091
type: 185.132.179.9:6892
type: 54.77.218.23:6892
type: 35.171.49.86:6892
type: 62.73.69.210:22160
type: 216.39.248.235:3915
type: 23.158.56.120:26096
type: 178.162.173.105:28003
type: 46.232.211.197:64161
type: 23.162.56.55:10048
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 85.113.130.141:61486
type: 37.48.111.227:50184
type: 176.136.72.83:33744
type: 185.21.217.17:54150
type: 185.203.56.49:23780
type: 37.48.95.144:22736
type: 45.152.210.34:50171
type: 178.162.174.102:28007
type: 178.162.174.96:28007
type: 161.129.65.58:26659
type: 178.162.174.226:28005
type: 91.199.227.109:10703
type: 45.13.6.185:28260
type: 46.232.211.148:11209
type: 81.171.20.66:64010
type: 47.143.201.203:61243
type: 31.223.96.174:40524
type: 187.243.215.224:5241
type: 89.10.239.29:56176
type: 114.34.138.206:51417
type: 95.84.146.62:57186
type: 118.105.60.101:12288
type: 185.203.56.71:29815
type: 175.208.56.97:7932
type: 188.165.241.169:52304
type: 50.103.214.230:39821
type: 24.186.140.129:25027
type: 188.140.17.203:35725
type: 130.239.18.158:8517
type: 185.203.56.66:19542
type: 185.183.32.101:6883
type: 141.95.53.34:8663
type: 176.63.9.233:5743
type: 195.154.172.179:23562
type: 72.21.17.51:27811
type: 121.136.130.142:11575
type: 45.158.186.72:54058
type: 178.162.174.224:28015
type: 46.238.41.216:33124
type: 46.232.210.230:13309
type: 168.119.11.254:6886
type: 88.80.231.20:53284
type: 205.250.118.6:10459
type: 45.131.79.62:64097
type: 185.156.174.155:42230
type: 103.140.3.19:13800
type: 66.183.109.95:29258
type: 178.83.37.52:56624
type: 94.155.195.58:8873
type: 80.147.67.132:17463
type: 86.97.80.186:46965
type: 194.8.47.229:54464
type: 176.63.13.66:4002
type: 89.212.107.211:29513
type: 178.47.221.12:49001
type: 5.158.28.41:49001
type: 81.240.226.160:42959
type: 67.193.191.220:53600
type: 220.134.134.117:22551
type: 190.123.194.255:3177
type: 188.163.103.81:36366
type: 212.124.6.110:3611
type: 125.52.114.39:63895
type: 92.150.124.165:44725
type: 146.70.98.38:25082
type: 91.86.126.43:16881
type: 70.26.205.54:35499
type: 85.146.163.58:49218
type: 222.100.42.137:41051
type: 179.220.211.79:17958
type: 107.4.103.14:29245
type: 212.102.44.168:36594
type: 162.157.128.201:51877
type: 94.158.91.232:22349
type: 80.3.212.200:6882
type: 54.194.124.68:6882
type: 86.101.50.191:6882
type: 82.7.101.70:56347
type: 128.68.185.133:16436
type: 186.23.28.149:48130
type: 190.213.178.173:31039
type: 138.97.45.58:7201
type: 195.154.172.179:26664
type: 65.108.143.34:53394
type: 90.243.56.23:12547
type: 78.58.139.19:51073
type: 212.102.44.168:57116
type: 211.179.46.129:48995
type: 190.46.75.229:22679
type: 24.124.42.228:58753
type: 93.175.201.140:44525
type: 65.108.143.34:46148
type: 95.24.164.208:51685
type: 5.77.203.99:41509
type: 37.27.113.233:32294
type: 65.108.143.34:49346
type: 46.232.210.217:12909
type: 158.140.161.27:11341
type: 152.53.105.61:10240
type: 212.102.37.185:56077
type: 91.197.220.87:49451
type: 38.224.19.40:53476
type: 130.239.18.158:8525
type: 121.139.124.7:60835
type: 166.48.12.232:14689
type: 82.1.178.91:56646
type: 76.82.234.123:50322
type: 177.148.30.223:5881
type: 186.219.142.181:33851
type: 184.22.106.141:39108
type: 45.152.210.7:51160
type: 188.165.244.11:53807
type: 62.210.71.154:32516
type: 190.101.74.196:56933
type: 59.188.200.88:18766
type: 185.253.218.52:40336
type: 39.118.77.132:65013
type: 68.62.105.169:40581
type: 45.87.251.132:28129
type: 177.93.199.6:41828

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5daf7cd3-5b7c-48b7-93dd-33b4fe12f797

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-06-08 03:07:23 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ticbabee5ei5ell66dfhmhisqdsrvhek2v63uhp7rm4vyh2pk3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250608-dmg3favrx3/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/60f35131-400f-414e-98d3-97766134ff4e

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf e4d020802427488e916bf78653b0e8940728d4e456abedd0effc59cae0fa7ab7

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558224/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample