MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd
SHA3-384 hash: 9d8ed49d1c53ee29810a868fc5590561022954737eff0277ec513773d4e12dacd119ad75bc0bd4bf4a1fe7c3c20812d4
SHA1 hash: a3ed2877f9f48f657f81c2c467a056783894487e
MD5 hash: 63075e7dfd633a1872abe324c2506bbf
humanhash: artist-washington-chicken-timing
File name:aarch64
Download: download sample
File size:509'896 bytes
First seen:2025-07-01 23:08:21 UTC
Last seen:2025-07-02 22:20:22 UTC
File type: elf
MIME type:application/x-executable
ssdeep 6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH T142B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
6
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68646ae9c9eb974737654a81linux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creates directories
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
exploit gcc
Link:
https://www.filescan.io/uploads/68646aa5714e106cecb93a73/reports/778cf428-0a05-49b0-80d6-cbd65a79b9b0/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
false
Architecture:
arm
Packer:
custom
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
46136
Full report:
https://elfdigest.com/brief/efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 216.128.97.44:6881
type: 82.66.207.143:6881
type: 5.165.203.111:6881
type: 104.195.12.42:6881
type: 86.138.169.36:6881
type: 185.10.222.178:6881
type: 54.214.62.31:6881
type: 87.78.182.154:6881
type: 209.226.242.194:6881
type: 61.244.124.14:6881
type: 201.145.66.188:6881
type: 54.214.62.55:6881
type: 187.5.81.129:6881
type: 81.56.8.196:6881
type: 18.191.2.28:6881
type: 141.11.92.129:6881
type: 164.68.113.202:6881
type: 18.221.7.72:6881
type: 142.171.58.199:6881
type: 51.15.20.12:6881
type: 35.167.186.212:6881
type: 91.242.192.146:6881
type: 75.119.138.164:6881
type: 46.49.34.112:6881
type: 178.162.174.43:28004
type: 178.162.174.228:28004
type: 178.162.174.149:28004
type: 178.162.174.34:28004
type: 178.162.174.149:28001
type: 178.162.173.227:28001
type: 178.162.174.178:28001
type: 130.239.18.158:8524
type: 79.106.231.163:1434
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 65.21.125.166:50000
type: 37.27.119.253:50000
type: 95.216.13.168:50000
type: 144.76.220.196:50000
type: 37.27.119.239:50000
type: 37.27.119.182:50000
type: 178.162.174.222:28014
type: 130.239.18.158:8515
type: 185.149.91.171:51010
type: 185.203.56.68:62927
type: 178.162.173.141:28000
type: 185.107.71.103:44737
type: 178.79.124.85:46405
type: 37.48.89.181:48531
type: 130.239.18.158:8580
type: 83.149.84.32:28008
type: 178.162.174.222:28011
type: 178.162.173.204:28013
type: 104.195.12.40:25829
type: 195.154.233.74:6880
type: 154.202.133.136:6880
type: 45.203.206.54:6880
type: 148.153.170.2:6880
type: 3.129.46.76:6880
type: 93.165.252.80:11887
type: 142.202.48.88:10099
type: 23.158.56.119:10099
type: 151.80.32.25:50562
type: 183.97.84.214:65339
type: 188.166.98.93:51413
type: 138.199.27.226:51413
type: 62.210.209.247:51413
type: 76.226.64.225:51413
type: 45.91.211.21:51413
type: 175.177.213.114:51413
type: 5.39.92.141:51413
type: 209.122.38.190:51413
type: 68.42.56.71:51413
type: 77.33.20.72:51413
type: 81.170.242.178:51413
type: 119.162.5.49:51413
type: 90.154.56.106:51413
type: 92.33.202.18:51413
type: 46.232.210.171:64036
type: 118.104.227.36:20242
type: 185.203.56.12:18410
type: 178.162.173.105:28003
type: 5.29.21.240:10359
type: 178.162.174.105:28015
type: 200.148.34.96:7655
type: 151.135.213.208:37333
type: 37.48.111.133:58392
type: 162.217.6.177:44856
type: 109.186.37.60:13199
type: 77.111.57.40:61258
type: 105.109.179.100:43072
type: 145.53.221.83:16881
type: 51.159.34.109:57558
type: 173.80.112.208:54672
type: 46.232.211.171:58173
type: 79.116.173.49:6889
type: 151.224.105.172:6889
type: 159.196.21.73:6889
type: 37.48.89.149:63915
type: 212.102.49.82:28580
type: 107.190.186.182:20545
type: 72.21.17.42:63163
type: 24.102.243.5:49001
type: 185.163.237.71:49001
type: 95.172.100.65:49001
type: 80.84.125.198:49001
type: 37.200.90.58:49001
type: 109.111.176.253:49001
type: 159.196.22.111:55402
type: 46.232.211.240:63336
type: 86.49.249.40:15817
type: 185.149.91.169:20029
type: 57.129.45.81:8641
type: 158.69.127.51:59979
type: 218.252.73.177:15277
type: 89.149.204.83:54909
type: 195.154.185.217:26607
type: 77.71.132.252:38799
type: 167.248.20.105:41882
type: 111.238.168.190:62179
type: 172.117.186.129:3900
type: 47.16.111.222:6891
type: 93.40.195.163:1318
type: 45.87.251.165:56595
type: 49.230.181.100:35115
type: 118.148.64.95:23960
type: 77.81.142.246:22156
type: 178.162.174.224:28010
type: 178.162.173.144:28010
type: 95.42.168.248:46278
type: 86.100.79.225:10192
type: 122.100.205.2:8999
type: 177.184.243.91:19305
type: 84.208.165.76:24470
type: 149.40.59.129:64071
type: 37.48.80.17:42771
type: 191.101.51.80:32206
type: 45.87.251.165:56537
type: 195.154.168.99:33627
type: 114.18.201.152:16692
type: 221.127.142.236:64014
type: 89.149.52.39:26119
type: 77.78.14.73:38893
type: 83.149.84.32:28036
type: 85.138.209.222:31366
type: 91.218.67.23:54806
type: 67.144.35.195:57639
type: 208.87.240.21:11158
type: 43.240.149.123:32681
type: 73.96.126.102:11246
type: 93.56.153.113:64735
type: 95.168.162.180:4639
type: 5.135.156.163:56843
type: 72.21.17.65:51734
type: 179.6.56.177:39422
type: 54.77.218.23:6892
type: 83.253.102.77:62096
type: 152.53.105.61:10240
type: 152.53.104.128:10240
type: 54.39.52.64:32205
type: 66.70.178.54:45499
type: 54.39.52.64:48853
type: 181.188.178.4:20165
type: 189.217.91.55:47107
type: 78.142.231.133:6767
type: 217.121.231.94:59625
type: 93.112.212.94:50097
type: 182.60.7.249:53563
type: 59.135.144.121:22011
type: 109.207.116.49:56299
type: 82.165.214.143:65431
type: 45.139.213.189:27884
type: 87.65.93.176:57280
type: 130.239.18.158:8521
type: 178.162.174.236:28005
type: 178.162.173.218:28005
type: 5.79.93.242:61920
type: 72.21.17.42:62740
type: 201.79.88.34:56350
type: 72.21.17.105:31024
type: 185.203.56.53:62652
type: 43.133.45.199:50253
type: 157.90.91.177:30298
type: 46.232.211.200:11909
type: 220.92.75.144:54017
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5c64bcbf-dd25-46b6-80be-c1ec2c35f363
Behavior Graph:
Download SVG
%3 guuid=674084a1-1600-0000-5ded-0406ee0b0000 pid=3054 /usr/bin/sudo guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062 /tmp/sample.bin guuid=674084a1-1600-0000-5ded-0406ee0b0000 pid=3054->guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062 execve guuid=0c66b8a4-1600-0000-5ded-0406fa0b0000 pid=3066 /usr/bin/dash guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062->guuid=0c66b8a4-1600-0000-5ded-0406fa0b0000 pid=3066 clone guuid=8f74cba4-1600-0000-5ded-0406fc0b0000 pid=3068 /usr/bin/dash guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062->guuid=8f74cba4-1600-0000-5ded-0406fc0b0000 pid=3068 clone guuid=a4b1e0a4-1600-0000-5ded-0406fd0b0000 pid=3069 /usr/bin/dash guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062->guuid=a4b1e0a4-1600-0000-5ded-0406fd0b0000 pid=3069 clone guuid=cfcaeda4-1600-0000-5ded-0406fe0b0000 pid=3070 /usr/bin/dash guuid=3419dda3-1600-0000-5ded-0406f60b0000 pid=3062->guuid=cfcaeda4-1600-0000-5ded-0406fe0b0000 pid=3070 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/fc3e278d-48ea-45b6-b58f-e57220da0e9e
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1726741
Signature
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1726741 Sample: aarch64.elf Startdate: 02/07/2025 Architecture: LINUX Score: 64 38 5.18.102.185, 6881, 9109 ZTELECOM-ASRU Russian Federation 2->38 40 119.18.0.146, 59105 WIDEBAND-AS-APAussieBroadbandAU Australia 2->40 42 102 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 10 aarch64.elf 2->10         started        signatures3 process4 process5 12 aarch64.elf sh 10->12         started        14 aarch64.elf 10->14         started        17 aarch64.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        52 Opens /sys/class/net/* files useful for querying network interface information 14->52 54 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->54 25 aarch64.elf 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.sEgSau, ASCII 19->36 dropped 46 Sample tries to persist itself using cron 19->46 48 Executes the "crontab" command typically for achieving persistence 19->48 29 sh crontab 23->29         started        32 aarch64.elf 25->32         started        signatures9 process10 signatures11 50 Executes the "crontab" command typically for achieving persistence 29->50 34 aarch64.elf 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd/
Verdict:
Malicious
Threat:
Linux.Trojan.SAgnt
Link:
https://tip.neiki.dev/file/efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd
Threat name:
Linux.Trojan.SAgnt
Create hunting rule
Status:
Malicious
First seen:
2025-07-01 23:09:25 UTC
File Type:
ELF64 Little (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=56vqgskbcodnbcmgegey2cmfk5lm35kfntgp4u22hrjwwhu3q26q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/250701-24rj7sej3y/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/44bae52f-2647-4267-9b46-4b42364658bd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf efab0349411386d0898621898d09855756cdf5456cccfe535a3c536b1e9b86bd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3558221/
  
Delivery method
Distributed via web download

Comments