MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1
SHA3-384 hash:	ee610dbe73a6f310855cbefb8163090415e53abefe7f1336f190fe2fab64fbc9f2739f0733adfdc38918f6e3df8ce292
SHA1 hash:	76acc2c7e6fb3d3e5272dc50ae84964bd179fef3
MD5 hash:	10e162c569cc9cf74762ebe3a05485a8
humanhash:	massachusetts-one-victor-berlin
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-06-26 16:57:11 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T1BCA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685d7c01b06783b9ebd8429clinux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Runs as daemon

Creates directories

Creating a process from a recently created file

Creating a file

Creating a file in the %temp% directory

Connection attempt

Locks files

Opens a port

Changes access rights for a written file

Collects information on the CPU

Receives data from a server

Sends data to a server

DNS request

Changes the time when the file was created, accessed, or modified

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/685d7bfb45e80b29f89ffc69/reports/cefb4962-7c60-484a-b1fb-0369d5a9dd88/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 23.118.129.219:6881
type: 178.69.209.93:6881
type: 63.247.211.162:6881
type: 159.65.34.10:6881
type: 95.66.217.20:6881
type: 37.19.41.151:6881
type: 3.95.182.191:6881
type: 70.75.101.196:6881
type: 185.188.249.20:6881
type: 46.0.4.68:6881
type: 87.66.137.134:6881
type: 83.246.143.195:6881
type: 77.251.252.105:6881
type: 118.93.189.165:6881
type: 47.32.239.226:6881
type: 69.165.228.60:6881
type: 118.232.144.28:6881
type: 31.16.175.226:6881
type: 51.148.64.129:6881
type: 5.252.153.178:6881
type: 61.92.93.116:6881
type: 36.236.75.222:6881
type: 125.130.114.8:6881
type: 176.93.127.241:6881
type: 176.165.160.229:6881
type: 95.155.192.240:6881
type: 13.58.27.33:6881
type: 77.125.60.107:6881
type: 179.175.139.222:6881
type: 179.126.140.155:6881
type: 85.89.171.25:6881
type: 35.163.251.58:6881
type: 176.95.158.232:6881
type: 141.98.154.145:6881
type: 18.220.82.190:6881
type: 89.189.179.154:6881
type: 139.162.168.10:6881
type: 75.119.138.164:6881
type: 5.189.120.179:6881
type: 54.70.174.84:6881
type: 54.70.28.180:6881
type: 84.247.141.118:6881
type: 174.6.109.198:6881
type: 217.162.45.36:6881
type: 79.156.128.223:6881
type: 92.154.51.199:6881
type: 128.69.179.195:6881
type: 97.82.254.13:6881
type: 83.48.35.139:6881
type: 178.162.174.222:28014
type: 178.162.173.226:28014
type: 5.79.80.223:28014
type: 178.162.174.82:28014
type: 178.162.174.77:28014
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 178.162.174.40:28004
type: 178.162.173.160:28004
type: 178.162.174.81:28004
type: 135.181.238.57:50000
type: 65.21.128.240:50000
type: 65.21.129.58:50000
type: 65.21.129.61:50000
type: 37.27.119.125:50000
type: 135.181.227.241:50000
type: 37.27.119.253:50000
type: 65.21.125.166:50000
type: 37.27.117.180:50000
type: 65.21.129.56:50000
type: 167.235.10.94:50000
type: 37.27.103.248:50000
type: 65.21.125.186:50000
type: 135.181.227.244:50000
type: 130.239.18.158:8524
type: 5.9.41.13:53504
type: 178.162.174.169:28003
type: 178.162.173.91:28003
type: 178.162.173.105:28003
type: 31.210.173.50:27520
type: 178.162.174.228:28007
type: 178.162.173.139:28007
type: 178.162.173.141:28000
type: 178.162.174.143:28000
type: 178.162.174.56:28000
type: 178.162.174.121:28000
type: 178.162.173.225:28000
type: 37.48.89.181:48531
type: 138.19.32.236:20005
type: 178.162.174.222:28011
type: 95.211.127.54:28011
type: 185.255.237.2:31672
type: 178.162.173.38:28009
type: 178.162.174.102:28009
type: 130.239.18.158:8500
type: 195.154.233.74:6880
type: 3.141.159.213:6880
type: 3.12.65.135:6880
type: 148.153.170.2:6880
type: 50.17.19.6:6880
type: 52.21.231.83:6880
type: 185.196.61.129:6880
type: 75.119.133.183:4489
type: 185.203.56.53:25320
type: 51.159.104.61:8940
type: 178.162.173.3:28010
type: 178.162.173.110:28010
type: 77.247.181.213:49425
type: 162.251.63.78:12035
type: 130.239.18.158:8580
type: 212.7.202.40:28027
type: 178.162.174.46:28013
type: 178.162.173.232:28013
type: 185.203.56.68:62927
type: 188.166.98.93:51413
type: 77.174.206.68:51413
type: 178.70.30.2:51413
type: 93.89.141.246:51413
type: 5.39.95.146:51413
type: 5.135.158.154:51413
type: 95.211.81.107:51413
type: 220.86.123.24:51413
type: 149.75.40.82:51413
type: 158.180.46.199:51413
type: 84.82.1.13:51413
type: 37.187.113.100:51413
type: 79.152.116.48:51413
type: 131.147.183.178:51413
type: 83.149.84.32:28008
type: 178.162.174.53:28008
type: 172.96.121.2:6884
type: 178.162.174.45:28015
type: 130.239.18.158:8513
type: 178.79.124.85:46405
type: 5.79.93.242:61920
type: 121.161.181.163:32748
type: 213.227.152.73:28002
type: 142.202.48.88:10099
type: 23.158.56.119:10004
type: 95.111.230.250:10007
type: 107.189.30.156:9671
type: 178.162.173.13:28001
type: 178.162.174.178:28001
type: 178.162.173.137:28001
type: 89.149.202.3:28034
type: 57.128.101.96:47019
type: 222.105.33.107:32900
type: 46.232.211.211:58145
type: 95.168.168.234:52277
type: 185.203.56.70:55836
type: 46.232.211.211:64183
type: 64.226.83.235:1434
type: 79.106.231.163:1434
type: 195.201.179.130:16309
type: 130.239.18.158:8516
type: 45.91.208.243:51936
type: 89.253.90.76:14229
type: 185.107.71.103:44737
type: 72.52.99.201:11214
type: 46.232.210.157:64170
type: 82.172.167.161:6889
type: 91.44.166.109:6889
type: 213.66.39.119:6889
type: 83.136.138.236:6889
type: 212.252.21.196:6889
type: 39.118.94.105:6889
type: 130.239.18.158:8515
type: 189.48.170.219:52246
type: 97.90.33.63:8096
type: 89.58.14.165:2145
type: 125.231.72.44:24649
type: 45.231.201.69:33138
type: 163.172.96.200:50161
type: 95.84.207.134:49001
type: 64.150.217.251:49001
type: 92.15.116.116:49001
type: 95.72.151.131:49001
type: 86.49.230.113:26206
type: 45.91.211.236:65156
type: 174.88.46.26:57719
type: 133.123.175.218:28262
type: 185.203.56.54:26317
type: 45.152.209.125:57442
type: 5.79.77.74:48937
type: 175.210.169.194:21939
type: 88.235.117.50:54346
type: 91.237.41.7:21799
type: 89.149.202.104:20851
type: 75.185.109.171:23009
type: 112.186.224.192:40941
type: 213.227.151.242:15182
type: 46.232.210.210:18509
type: 94.231.2.226:37950
type: 221.164.141.229:7882
type: 81.171.17.56:63829
type: 185.162.184.11:51494
type: 2.57.253.37:40662
type: 78.139.125.6:1415
type: 5.180.242.34:1026
type: 74.135.80.245:21625
type: 185.162.184.40:60446
type: 185.162.184.40:60332
type: 143.58.153.64:61153
type: 125.139.77.9:40826
type: 140.228.21.231:38166
type: 179.108.66.17:61651
type: 71.60.36.1:8917
type: 71.208.139.17:24104
type: 66.181.187.101:3219
type: 211.53.6.180:40905
type: 37.48.89.195:58400
type: 88.217.154.130:60081
type: 47.205.222.230:56969
type: 102.158.62.195:31357
type: 86.16.171.141:6888
type: 50.35.46.190:8999
type: 178.199.61.99:63400
type: 192.141.86.71:29843
type: 80.3.51.27:58547
type: 68.8.14.149:17018
type: 31.10.150.194:46631
type: 77.53.172.147:43096
type: 160.30.241.20:6882
type: 54.194.137.170:6882
type: 41.96.88.29:55236
type: 190.106.209.240:39980
type: 196.207.222.232:10473
type: 80.151.106.169:45623
type: 54.39.52.64:29129
type: 149.56.27.121:58813
type: 152.53.45.107:7086
type: 152.53.45.107:7092
type: 176.63.30.232:24289
type: 121.139.183.146:7825
type: 121.166.33.109:7604
type: 152.53.45.107:7090
type: 123.248.177.207:41315
type: 221.144.112.240:40946
type: 60.132.76.214:57060
type: 124.61.217.196:32891
type: 112.149.84.181:42055
type: 176.174.114.166:64176
type: 178.162.173.144:28006
type: 144.76.175.153:48067
type: 78.167.143.36:37424
type: 195.154.185.217:24533
type: 5.135.138.216:14377
type: 120.131.13.214:60020
type: 128.1.160.106:60020
type: 54.36.168.18:46075
type: 185.107.68.193:20703
type: 106.105.86.225:11142
type: 185.203.56.50:59687
type: 178.162.174.236:28005
type: 174.86.161.49:24782
type: 92.247.211.161:29542
type: 181.164.197.161:38680
type: 46.232.211.223:64284
type: 95.168.168.13:15166
type: 221.152.2.192:7920
type: 47.133.221.106:64875
type: 61.77.246.109:41141
type: 73.20.67.76:37535
type: 150.109.111.251:10020
type: 221.148.20.20:8046
type: 170.84.177.201:41380
type: 37.27.113.233:38864
type: 121.134.233.22:32941
type: 203.243.38.14:33141

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/28a3ba78-88c6-435a-af27-356b137a6e83

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/79fa5845-4ba1-47b9-865f-43aabdf78c23

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-26 16:58:27 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4uf3plv43ibrjjvw4kxlmpbfk5ep7olonqrh7phdee4ooij26pqq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250626-vgjgrabk7w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9ef342e1-af9f-4122-9b3a-271898d63bee

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558478/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample