MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ea60e72326671fed201c803ba387cc0f05a98081b8b609631d11c5f8142caa08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | ea60e72326671fed201c803ba387cc0f05a98081b8b609631d11c5f8142caa08 |
|---|---|
| SHA3-384 hash: | 65f79cc74525a773126769d3ef82d8fb4ec7bbf10287613f51cee101c328e661d45f54b8e4a5669f439c25a3912b3721 |
| SHA1 hash: | d3629fd1869d796e01de85710042e673d716a0f0 |
| MD5 hash: | dd6d3e1f08269444351cc4a1bfcead87 |
| humanhash: | yellow-hydrogen-sixteen-papa |
| File name: | mips |
| Download: | download sample |
| File size: | 592'688 bytes |
| First seen: | 2025-06-20 16:48:21 UTC |
| Last seen: | 2025-06-20 20:10:09 UTC |
| File type: | elf |
| MIME type: | application/x-executable |
| ssdeep | 12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zM:W7v+mrY2xzf03yvZ/YIs |
| TLSH | T1FCC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9 |
| telfhash | t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18 |
| Magika | elf |
| Reporter |  abuse_ch |
| Tags: | elf |
Intelligence
File Origin
# of uploads :
2
# of downloads :
69
Origin country :
DEVendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Creates directories
Sends data to a server
Creating a process from a recently created file
Changes the time when the file was created, accessed, or modified
Locks files
Connection attempt
Changes access rights for a written file
Launching a process
Opens a port
Runs as daemon
Receives data from a server
DNS request
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
base64 exploit gcc lolbin remote
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
mips
Packer:
custom
Botnet:
unknown
Number of open files:
60
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
34811
Full report:
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 88.101.93.63:6881
type: 37.110.114.110:6881
type: 84.28.2.133:6881
type: 109.237.230.231:6881
type: 95.158.219.75:6881
type: 175.123.205.158:6881
type: 178.69.209.93:6881
type: 73.208.41.226:6881
type: 176.114.36.203:6881
type: 95.79.250.103:6881
type: 172.96.121.2:6881
type: 178.62.92.23:6881
type: 37.48.71.94:6881
type: 217.150.79.160:6881
type: 207.188.137.100:6881
type: 23.19.64.216:6881
type: 31.53.223.221:6881
type: 81.107.202.22:6881
type: 86.26.3.41:6881
type: 220.92.204.2:6881
type: 111.217.125.144:6881
type: 79.156.229.66:6881
type: 121.167.235.137:6881
type: 54.70.28.180:6881
type: 35.155.156.153:6881
type: 217.197.248.49:6881
type: 89.22.226.106:6881
type: 195.158.11.167:6881
type: 18.223.137.220:6881
type: 54.70.174.84:6881
type: 18.221.7.72:6881
type: 59.126.51.172:6881
type: 207.211.188.57:6881
type: 129.146.73.26:6881
type: 13.58.27.33:6881
type: 18.191.2.28:6881
type: 18.190.61.127:6881
type: 87.110.25.155:6881
type: 5.103.138.215:6881
type: 54.214.62.55:6881
type: 185.212.9.52:6881
type: 90.19.176.229:6881
type: 54.194.137.170:6881
type: 130.239.18.158:8516
type: 140.245.76.181:9081
type: 130.239.18.158:8580
type: 148.153.188.242:6880
type: 52.21.231.83:6880
type: 45.203.155.80:6880
type: 34.233.90.2:6880
type: 195.154.233.74:6880
type: 3.131.250.123:6880
type: 37.27.117.115:50000
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 95.216.13.53:50000
type: 65.21.33.212:50000
type: 142.132.207.60:50000
type: 135.181.223.82:50000
type: 185.183.35.248:6883
type: 178.162.174.222:28014
type: 84.247.173.42:8081
type: 112.105.0.58:25574
type: 5.9.41.13:53504
type: 181.90.142.92:56226
type: 181.177.219.39:16276
type: 181.59.2.196:11155
type: 125.238.63.12:51413
type: 118.241.201.120:51413
type: 95.211.7.108:51413
type: 188.90.169.20:51413
type: 89.223.38.206:51413
type: 185.183.195.12:51413
type: 122.215.145.122:51413
type: 129.213.144.41:51413
type: 184.61.54.109:51413
type: 80.78.240.228:51413
type: 193.37.152.117:51413
type: 86.57.236.42:51413
type: 213.170.70.213:51413
type: 133.242.167.213:51413
type: 188.4.157.57:51413
type: 162.19.243.205:51413
type: 189.203.94.148:39638
type: 187.189.173.9:8806
type: 45.87.251.132:28119
type: 57.129.4.81:36112
type: 222.155.234.132:29838
type: 83.149.72.73:28007
type: 45.87.251.6:28020
type: 81.161.165.71:6666
type: 168.126.35.214:32978
type: 188.165.231.77:52053
type: 178.162.174.169:28003
type: 178.162.173.91:28003
type: 85.17.84.50:28003
type: 46.232.210.157:64170
type: 82.172.167.161:6889
type: 91.219.253.179:6889
type: 85.247.50.125:6889
type: 89.44.229.114:6889
type: 161.97.245.51:6889
type: 81.242.255.55:6889
type: 31.210.173.50:27520
type: 45.91.211.169:54413
type: 76.144.65.17:32500
type: 185.21.216.138:65426
type: 185.162.184.22:54031
type: 88.198.230.221:54817
type: 193.39.142.75:51389
type: 138.75.251.40:10262
type: 115.38.21.252:26062
type: 118.103.61.74:58835
type: 112.170.193.136:7705
type: 106.155.189.134:9454
type: 209.9.206.79:10260
type: 1.65.172.178:13578
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 80.78.21.168:55521
type: 37.120.213.198:30243
type: 90.118.225.107:13655
type: 46.11.175.101:14107
type: 85.235.66.132:23334
type: 3.87.44.204:20965
type: 130.239.18.158:8501
type: 172.111.38.128:26042
type: 46.232.211.130:16609
type: 23.162.56.55:10066
type: 211.26.55.70:37269
type: 178.162.174.82:28010
type: 178.162.173.153:28010
type: 95.168.168.222:55106
type: 87.229.85.53:55113
type: 177.226.79.160:30840
type: 185.148.3.216:49991
type: 211.222.174.164:32995
type: 130.239.18.158:8513
type: 85.17.20.150:28008
type: 184.82.26.135:10646
type: 220.130.79.187:8645
type: 41.214.49.51:33205
type: 95.85.136.7:56170
type: 46.232.211.247:64388
type: 37.48.118.89:28009
type: 178.162.174.229:28009
type: 178.162.174.235:28009
type: 153.169.240.221:24751
type: 89.149.202.17:28073
type: 193.168.55.152:32821
type: 212.55.254.189:64013
type: 212.7.203.106:25884
type: 14.39.184.83:7878
type: 123.243.90.51:14082
type: 142.189.199.175:14082
type: 83.106.117.210:51414
type: 142.116.32.219:51803
type: 90.226.9.251:47591
type: 118.37.124.137:32851
type: 185.244.154.107:64984
type: 1.42.157.3:57125
type: 176.62.82.145:49001
type: 178.248.141.57:49001
type: 91.195.86.143:49001
type: 119.198.171.112:33057
type: 80.151.109.80:30331
type: 51.159.104.70:8623
type: 193.210.201.81:15922
type: 129.227.103.18:60020
type: 41.82.207.176:46211
type: 175.192.152.157:41074
type: 175.192.24.157:40076
type: 49.204.100.129:61746
type: 99.59.165.19:14780
type: 59.21.235.61:40771
type: 119.207.19.21:7898
type: 183.104.13.193:7906
type: 195.154.185.217:26873
type: 109.137.232.185:15494
type: 216.174.113.224:51559
type: 45.131.79.64:64132
type: 178.162.173.228:28005
type: 178.162.174.65:28005
type: 77.101.161.227:42872
type: 47.202.150.211:4021
type: 85.187.116.252:29993
type: 27.60.7.206:58393
type: 144.76.175.153:45563
type: 181.87.41.76:42362
type: 185.113.97.131:2473
type: 67.173.164.114:16406
type: 89.64.73.45:14039
type: 152.171.106.192:62530
type: 211.228.236.120:40462
type: 54.77.218.23:6992
type: 106.77.184.80:13420
type: 31.39.184.163:45973
type: 217.121.74.53:37985
type: 73.25.138.53:57294
type: 189.215.9.35:46167
type: 78.142.231.133:6767
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 162.55.243.114:3910
type: 152.53.45.107:7138
type: 149.56.27.121:62247
type: 107.173.149.140:6339
type: 178.162.173.25:28002
type: 75.217.43.153:25116
type: 13.114.205.93:6892
type: 78.147.36.173:14238
type: 63.143.116.233:48959
type: 41.214.49.254:25578
type: 151.249.196.45:15191
type: 95.214.53.172:1688
type: 51.75.78.69:6882
type: 188.165.201.194:6882
type: 54.194.137.170:6882
type: 97.178.240.114:6882
type: 54.39.52.64:23883
type: 69.63.18.10:49196
type: 195.154.178.158:8664
type: 212.7.202.40:28027
type: 209.216.163.55:46116
type: 65.108.143.34:53508
type: 144.76.175.153:37506
type: 65.108.143.34:37506
type: 144.76.175.153:53890
type: 5.79.98.129:47150
type: 185.149.91.187:51087
type: 195.154.172.179:26862
type: 65.108.143.34:53889
type: 37.27.113.233:53889
type: 37.27.113.233:37505
type: 144.76.175.153:37505
type: 67.20.1.235:53917
type: 119.193.186.89:41043
type: 220.94.222.65:33087
type: 185.21.217.44:52624
type: 178.162.173.149:28015
type: 195.154.185.217:26403
type: 95.168.168.222:26128
type: 110.140.132.36:21399
type: 89.22.196.117:48481
type: 195.154.172.179:28414
type: 81.250.67.250:46393
type: 121.137.183.104:32897
type: 113.211.212.87:4984
type: 89.82.247.187:55722
type: 65.108.143.34:37533
type: 152.53.45.107:7345
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 88.101.93.63:6881
type: 37.110.114.110:6881
type: 84.28.2.133:6881
type: 109.237.230.231:6881
type: 95.158.219.75:6881
type: 175.123.205.158:6881
type: 178.69.209.93:6881
type: 73.208.41.226:6881
type: 176.114.36.203:6881
type: 95.79.250.103:6881
type: 172.96.121.2:6881
type: 178.62.92.23:6881
type: 37.48.71.94:6881
type: 217.150.79.160:6881
type: 207.188.137.100:6881
type: 23.19.64.216:6881
type: 31.53.223.221:6881
type: 81.107.202.22:6881
type: 86.26.3.41:6881
type: 220.92.204.2:6881
type: 111.217.125.144:6881
type: 79.156.229.66:6881
type: 121.167.235.137:6881
type: 54.70.28.180:6881
type: 35.155.156.153:6881
type: 217.197.248.49:6881
type: 89.22.226.106:6881
type: 195.158.11.167:6881
type: 18.223.137.220:6881
type: 54.70.174.84:6881
type: 18.221.7.72:6881
type: 59.126.51.172:6881
type: 207.211.188.57:6881
type: 129.146.73.26:6881
type: 13.58.27.33:6881
type: 18.191.2.28:6881
type: 18.190.61.127:6881
type: 87.110.25.155:6881
type: 5.103.138.215:6881
type: 54.214.62.55:6881
type: 185.212.9.52:6881
type: 90.19.176.229:6881
type: 54.194.137.170:6881
type: 130.239.18.158:8516
type: 140.245.76.181:9081
type: 130.239.18.158:8580
type: 148.153.188.242:6880
type: 52.21.231.83:6880
type: 45.203.155.80:6880
type: 34.233.90.2:6880
type: 195.154.233.74:6880
type: 3.131.250.123:6880
type: 37.27.117.115:50000
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 95.216.13.53:50000
type: 65.21.33.212:50000
type: 142.132.207.60:50000
type: 135.181.223.82:50000
type: 185.183.35.248:6883
type: 178.162.174.222:28014
type: 84.247.173.42:8081
type: 112.105.0.58:25574
type: 5.9.41.13:53504
type: 181.90.142.92:56226
type: 181.177.219.39:16276
type: 181.59.2.196:11155
type: 125.238.63.12:51413
type: 118.241.201.120:51413
type: 95.211.7.108:51413
type: 188.90.169.20:51413
type: 89.223.38.206:51413
type: 185.183.195.12:51413
type: 122.215.145.122:51413
type: 129.213.144.41:51413
type: 184.61.54.109:51413
type: 80.78.240.228:51413
type: 193.37.152.117:51413
type: 86.57.236.42:51413
type: 213.170.70.213:51413
type: 133.242.167.213:51413
type: 188.4.157.57:51413
type: 162.19.243.205:51413
type: 189.203.94.148:39638
type: 187.189.173.9:8806
type: 45.87.251.132:28119
type: 57.129.4.81:36112
type: 222.155.234.132:29838
type: 83.149.72.73:28007
type: 45.87.251.6:28020
type: 81.161.165.71:6666
type: 168.126.35.214:32978
type: 188.165.231.77:52053
type: 178.162.174.169:28003
type: 178.162.173.91:28003
type: 85.17.84.50:28003
type: 46.232.210.157:64170
type: 82.172.167.161:6889
type: 91.219.253.179:6889
type: 85.247.50.125:6889
type: 89.44.229.114:6889
type: 161.97.245.51:6889
type: 81.242.255.55:6889
type: 31.210.173.50:27520
type: 45.91.211.169:54413
type: 76.144.65.17:32500
type: 185.21.216.138:65426
type: 185.162.184.22:54031
type: 88.198.230.221:54817
type: 193.39.142.75:51389
type: 138.75.251.40:10262
type: 115.38.21.252:26062
type: 118.103.61.74:58835
type: 112.170.193.136:7705
type: 106.155.189.134:9454
type: 209.9.206.79:10260
type: 1.65.172.178:13578
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 80.78.21.168:55521
type: 37.120.213.198:30243
type: 90.118.225.107:13655
type: 46.11.175.101:14107
type: 85.235.66.132:23334
type: 3.87.44.204:20965
type: 130.239.18.158:8501
type: 172.111.38.128:26042
type: 46.232.211.130:16609
type: 23.162.56.55:10066
type: 211.26.55.70:37269
type: 178.162.174.82:28010
type: 178.162.173.153:28010
type: 95.168.168.222:55106
type: 87.229.85.53:55113
type: 177.226.79.160:30840
type: 185.148.3.216:49991
type: 211.222.174.164:32995
type: 130.239.18.158:8513
type: 85.17.20.150:28008
type: 184.82.26.135:10646
type: 220.130.79.187:8645
type: 41.214.49.51:33205
type: 95.85.136.7:56170
type: 46.232.211.247:64388
type: 37.48.118.89:28009
type: 178.162.174.229:28009
type: 178.162.174.235:28009
type: 153.169.240.221:24751
type: 89.149.202.17:28073
type: 193.168.55.152:32821
type: 212.55.254.189:64013
type: 212.7.203.106:25884
type: 14.39.184.83:7878
type: 123.243.90.51:14082
type: 142.189.199.175:14082
type: 83.106.117.210:51414
type: 142.116.32.219:51803
type: 90.226.9.251:47591
type: 118.37.124.137:32851
type: 185.244.154.107:64984
type: 1.42.157.3:57125
type: 176.62.82.145:49001
type: 178.248.141.57:49001
type: 91.195.86.143:49001
type: 119.198.171.112:33057
type: 80.151.109.80:30331
type: 51.159.104.70:8623
type: 193.210.201.81:15922
type: 129.227.103.18:60020
type: 41.82.207.176:46211
type: 175.192.152.157:41074
type: 175.192.24.157:40076
type: 49.204.100.129:61746
type: 99.59.165.19:14780
type: 59.21.235.61:40771
type: 119.207.19.21:7898
type: 183.104.13.193:7906
type: 195.154.185.217:26873
type: 109.137.232.185:15494
type: 216.174.113.224:51559
type: 45.131.79.64:64132
type: 178.162.173.228:28005
type: 178.162.174.65:28005
type: 77.101.161.227:42872
type: 47.202.150.211:4021
type: 85.187.116.252:29993
type: 27.60.7.206:58393
type: 144.76.175.153:45563
type: 181.87.41.76:42362
type: 185.113.97.131:2473
type: 67.173.164.114:16406
type: 89.64.73.45:14039
type: 152.171.106.192:62530
type: 211.228.236.120:40462
type: 54.77.218.23:6992
type: 106.77.184.80:13420
type: 31.39.184.163:45973
type: 217.121.74.53:37985
type: 73.25.138.53:57294
type: 189.215.9.35:46167
type: 78.142.231.133:6767
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 162.55.243.114:3910
type: 152.53.45.107:7138
type: 149.56.27.121:62247
type: 107.173.149.140:6339
type: 178.162.173.25:28002
type: 75.217.43.153:25116
type: 13.114.205.93:6892
type: 78.147.36.173:14238
type: 63.143.116.233:48959
type: 41.214.49.254:25578
type: 151.249.196.45:15191
type: 95.214.53.172:1688
type: 51.75.78.69:6882
type: 188.165.201.194:6882
type: 54.194.137.170:6882
type: 97.178.240.114:6882
type: 54.39.52.64:23883
type: 69.63.18.10:49196
type: 195.154.178.158:8664
type: 212.7.202.40:28027
type: 209.216.163.55:46116
type: 65.108.143.34:53508
type: 144.76.175.153:37506
type: 65.108.143.34:37506
type: 144.76.175.153:53890
type: 5.79.98.129:47150
type: 185.149.91.187:51087
type: 195.154.172.179:26862
type: 65.108.143.34:53889
type: 37.27.113.233:53889
type: 37.27.113.233:37505
type: 144.76.175.153:37505
type: 67.20.1.235:53917
type: 119.193.186.89:41043
type: 220.94.222.65:33087
type: 185.21.217.44:52624
type: 178.162.173.149:28015
type: 195.154.185.217:26403
type: 95.168.168.222:26128
type: 110.140.132.36:21399
type: 89.22.196.117:48481
type: 195.154.172.179:28414
type: 81.250.67.250:46393
type: 121.137.183.104:32897
type: 113.211.212.87:4984
type: 89.82.247.187:55722
type: 65.108.143.34:37533
type: 152.53.45.107:7345
Status:
terminated
Behavior Graph:
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
ELF
Threat name:
Linux.Trojan.Multiverze
Status:
Malicious
First seen:
2025-06-20 16:49:12 UTC
File Type:
ELF32 Big (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
antivm defense_evasion discovery execution persistence privilege_escalation
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Renames itself
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
elf ea60e72326671fed201c803ba387cc0f05a98081b8b609631d11c5f8142caa08
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.