MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93
SHA3-384 hash:	253f966a1a2f6e87b00773467444621fe26f5ea5f3036fab58c28f7f6b199709f729f5fd6b78b30fbfabe666e115d287
SHA1 hash:	6c6de388f2b83b8d4df2ee0804fa1e5872eae93c
MD5 hash:	bd5917f5804774c0e356bdafa916663f
humanhash:	single-tennis-rugby-fillet
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-07-15 00:07:08 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zI:W7v+mrY2xzf03yvZ/YIo
TLSH	T1ABC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

DNS request

Changes access rights for a written file

Locks files

Changes the time when the file was created, accessed, or modified

Receives data from a server

Creating a file

Runs as daemon

Connection attempt

Opens a port

Launching a process

Sends data to a server

Creating a process from a recently created file

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc packed

Link:

https://www.filescan.io/uploads/68759bbb8a7d628a81aeabec/reports/ac6e2575-e1cc-40ec-a077-90aedcb6a9b3/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

19325

Full report:

https://elfdigest.com/brief/f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 46.0.52.88:6881
type: 95.72.134.175:6881
type: 92.255.163.73:6881
type: 194.8.131.111:6881
type: 31.184.88.22:6881
type: 176.117.253.127:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 5.101.195.120:6881
type: 3.92.204.118:6881
type: 5.9.107.248:6881
type: 185.203.56.74:6881
type: 84.28.2.133:6881
type: 81.109.194.221:6881
type: 91.202.106.25:6881
type: 23.93.213.23:6881
type: 91.174.30.59:6881
type: 82.125.202.140:6881
type: 72.0.243.19:6881
type: 192.210.228.229:6881
type: 35.167.186.212:6881
type: 142.171.58.199:6881
type: 101.188.163.127:6881
type: 167.99.72.189:6881
type: 209.141.40.204:6881
type: 18.188.31.0:6881
type: 85.245.175.69:6881
type: 200.115.223.248:6881
type: 37.112.36.240:6881
type: 52.9.197.152:6881
type: 18.221.7.72:6881
type: 107.204.148.198:6881
type: 147.135.254.137:6881
type: 103.254.214.102:6881
type: 18.220.82.190:6881
type: 201.224.191.27:6881
type: 37.48.93.7:6881
type: 95.82.142.197:6881
type: 95.161.217.221:6881
type: 223.18.215.132:6881
type: 18.223.137.220:6881
type: 115.135.101.98:6881
type: 54.194.137.170:6881
type: 13.58.27.33:6881
type: 18.218.241.3:6881
type: 201.188.122.21:6881
type: 188.150.45.193:6881
type: 222.94.130.19:6881
type: 31.170.175.36:6881
type: 79.194.161.149:6881
type: 178.210.42.29:6881
type: 178.226.100.180:6881
type: 93.88.121.78:6881
type: 114.32.28.243:6881
type: 216.255.0.114:6881
type: 86.135.16.11:6881
type: 211.226.48.99:6881
type: 77.95.42.218:6881
type: 130.239.18.158:8516
type: 148.153.188.242:6880
type: 173.230.130.111:6880
type: 45.56.122.13:6880
type: 45.203.212.13:6880
type: 45.203.211.8:6880
type: 35.171.213.155:6880
type: 3.131.250.123:6880
type: 52.45.23.144:6880
type: 45.203.154.67:6880
type: 195.154.233.74:6880
type: 192.210.231.24:6880
type: 45.203.212.18:6880
type: 3.132.19.248:6880
type: 130.239.18.158:8513
type: 130.239.18.158:8597
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 178.162.173.32:28003
type: 51.38.81.200:8643
type: 178.162.173.149:28004
type: 178.162.174.43:28004
type: 178.162.173.21:28004
type: 178.162.174.223:28004
type: 178.162.174.235:28004
type: 46.232.211.180:51539
type: 66.135.10.213:6882
type: 176.49.248.196:6882
type: 125.30.52.95:6882
type: 163.172.38.214:51413
type: 95.31.49.135:51413
type: 195.210.21.55:51413
type: 195.154.243.15:51413
type: 37.187.1.102:51413
type: 151.80.44.142:51413
type: 86.218.39.28:51413
type: 140.210.79.62:51413
type: 101.6.42.182:51413
type: 213.231.5.66:51413
type: 193.32.16.100:51413
type: 178.61.161.159:51413
type: 5.3.207.73:51413
type: 80.85.150.237:51413
type: 51.175.156.191:51413
type: 180.255.88.214:51413
type: 178.162.173.103:28010
type: 178.162.173.138:28010
type: 178.162.174.226:28010
type: 178.162.173.117:28010
type: 178.162.174.181:28010
type: 178.162.173.12:28010
type: 185.203.56.55:29691
type: 130.239.18.158:8520
type: 172.245.52.213:21710
type: 65.108.198.44:50000
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 65.21.33.208:50000
type: 37.27.120.58:50000
type: 1.163.73.233:50000
type: 37.27.119.116:50000
type: 135.181.238.51:50000
type: 37.27.107.122:50000
type: 65.108.102.46:50000
type: 130.239.18.158:8508
type: 178.162.173.220:28014
type: 178.162.173.89:28014
type: 178.162.174.222:28014
type: 178.162.174.88:28014
type: 85.17.170.48:28011
type: 46.232.211.190:13709
type: 178.162.173.98:28000
type: 178.162.174.228:28000
type: 178.162.174.234:28000
type: 178.162.173.87:28000
type: 45.91.208.179:8999
type: 195.201.59.247:8999
type: 98.1.76.206:18873
type: 91.199.227.112:10304
type: 185.203.56.58:31823
type: 51.159.54.94:32546
type: 68.9.82.223:11226
type: 186.233.119.252:8081
type: 5.135.156.163:56843
type: 185.149.91.21:51118
type: 212.7.202.40:28030
type: 193.37.41.17:58625
type: 45.155.90.234:12538
type: 178.162.174.149:28001
type: 178.162.173.231:28001
type: 178.162.173.169:28001
type: 178.162.174.52:28001
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 147.135.129.139:52557
type: 130.239.18.158:8531
type: 178.162.173.160:28012
type: 178.162.174.168:28012
type: 178.162.173.145:28012
type: 178.162.173.153:28012
type: 178.162.173.32:28012
type: 130.239.18.158:8547
type: 130.239.18.158:8522
type: 37.48.95.6:23517
type: 178.162.173.222:28015
type: 178.162.173.154:28015
type: 178.162.173.13:28006
type: 95.168.162.161:42670
type: 130.239.18.158:8539
type: 178.162.173.24:28009
type: 178.162.173.99:28009
type: 130.239.18.158:8603
type: 185.149.91.131:51047
type: 169.150.223.235:64129
type: 130.239.18.158:8510
type: 178.162.173.102:28005
type: 62.212.81.227:28005
type: 178.162.173.228:28005
type: 178.162.173.159:28005
type: 178.162.173.203:28005
type: 178.162.173.44:28005
type: 178.162.173.147:28007
type: 178.162.173.164:28007
type: 51.159.104.68:7606
type: 95.211.20.1:21170
type: 81.171.22.205:28013
type: 95.211.218.207:28013
type: 81.171.22.85:28013
type: 90.242.64.254:64999
type: 140.245.76.181:9081
type: 130.239.18.158:8580
type: 2.61.168.213:49001
type: 95.32.236.25:49001
type: 104.172.39.146:49001
type: 46.242.71.224:49001
type: 74.74.160.53:49001
type: 92.24.194.253:63811
type: 112.141.43.115:60511
type: 185.149.91.31:51035
type: 89.134.3.76:5401
type: 84.221.245.80:54376
type: 212.32.244.170:56134
type: 85.193.192.212:14038
type: 203.218.167.147:22216
type: 83.177.223.182:10929
type: 24.222.146.219:55058
type: 183.97.142.137:41174
type: 84.20.227.165:6889
type: 90.149.180.53:6889
type: 212.39.75.110:42828
type: 188.165.198.46:50001
type: 24.101.0.170:45772
type: 211.193.225.16:7859
type: 185.21.217.17:55544
type: 222.99.133.137:41247
type: 106.71.100.214:20441
type: 187.148.34.213:54555
type: 189.105.59.200:44189
type: 51.158.148.45:54294
type: 1.242.114.153:41079
type: 124.60.138.7:33043
type: 118.42.180.136:40858
type: 180.177.3.63:9562
type: 193.123.246.154:3334
type: 80.153.228.36:62053
type: 45.51.39.129:6899
type: 46.117.124.11:29475
type: 64.231.97.141:49735
type: 64.231.97.141:53615
type: 185.107.71.117:12271
type: 95.168.162.185:64211
type: 81.171.17.35:43916
type: 76.68.127.250:45710
type: 41.249.157.74:56203
type: 46.232.210.123:64159
type: 106.242.174.149:59893
type: 102.157.72.74:47301
type: 106.221.136.74:37301
type: 187.52.38.19:45069
type: 85.245.39.4:50798
type: 84.105.113.154:12245
type: 14.39.92.221:7951
type: 58.143.145.211:41987
type: 152.53.104.128:10240
type: 194.29.101.83:10240
type: 221.146.89.242:40992
type: 31.164.38.19:50321
type: 189.6.251.149:7614
type: 121.165.173.90:32434
type: 46.232.210.150:16009
type: 125.13.4.41:62808
type: 66.70.178.54:65018
type: 121.131.109.63:32670
type: 183.107.10.114:41085
type: 89.26.69.208:64889
type: 159.146.40.242:45406
type: 210.113.203.229:37259
type: 190.33.75.229:61243
type: 181.164.181.31:25374
type: 117.20.117.31:26711
type: 109.255.132.246:55899
type: 59.13.66.103:32796
type: 85.75.132.176:14546
type: 185.241.227.181:16637
type: 18.196.86.103:6892
type: 54.209.131.199:6892
type: 77.201.12.31:42146
type: 54.38.92.16:62592
type: 95.8.157.166:42627
type: 35.171.49.86:6992
type: 103.207.224.111:52902
type: 185.149.91.141:51036
type: 89.149.217.131:30140
type: 178.162.174.46:28002
type: 95.211.216.167:28002
type: 105.102.44.25:33547
type: 51.37.169.11:21071
type: 137.74.95.127:15809
type: 95.216.116.106:16113
type: 195.20.18.136:11072
type: 5.79.93.242:61920
type: 162.55.95.146:51555
type: 54.39.52.64:48853
type: 212.32.253.227:21169
type: 45.91.208.243:51936
type: 59.27.232.204:40939
type: 185.203.56.71:21868
type: 65.108.143.34:30097
type: 80.152.136.98:30277
type: 46.232.210.217:17109
type: 185.149.91.17:51029
type: 169.150.223.223:64240
type: 72.21.17.105:11897
type: 141.95.53.34:8652
type: 116.49.240.144:45645
type: 86.49.229.185:64253
type: 84.10.28.77:31426
type: 185.21.216.198:62932

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7bfca586-87df-497c-a77e-6796073074c2

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/067fb2be-e6ee-4d47-8891-09a29c961190

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93/

Threat name:

Linux.Dropper.Multiverze

Status:

Malicious

First seen:

2025-07-15 00:08:23 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6a5gumadpzmxf37studtftalv2eczdndsbpqt4li235rk2lerkjq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250715-aehgfsaq2y/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5688da95-91b0-4c91-8e75-870fdba93e35

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf f03a6a30037e5972eff29d0732cc0bae882c8da3905f09f168d6fb1569648a93

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558165/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample