MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a
SHA3-384 hash:	e8124aa238e50db7389d46348b515df566230218da2da9c4e054377ecf8d44ab4b5c629b6405e5b2669bd944ad69126a
SHA1 hash:	675afde9658068d2674bafe1bcebb468ff34c1db
MD5 hash:	797e402d2cb935f3945fc0631086db9d
humanhash:	zebra-single-pasta-asparagus
File name:	i686
Download:	download sample
File size:	587'764 bytes
First seen:	2025-07-13 05:20:57 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
TLSH	T1B8C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31951.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6873424dc9eb97473768a6b6linux22vpnfull_triage

Tags:

shellcode

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creates directories

Locks files

Changes access rights for a written file

Changes the time when the file was created, accessed, or modified

Creating a process from a recently created file

Collects information on the CPU

Receives data from a server

Runs as daemon

Creating a file

Creating a file in the %temp% directory

Opens a port

Launching a process

Sends data to a server

Connection attempt

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin packed remote

Link:

https://www.filescan.io/uploads/6873424aa15b22faa8affcf5/reports/3e463b33-5b2c-4185-a403-7859cf1859df/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 89.179.246.14:6881
type: 82.191.145.91:6881
type: 148.63.132.234:6881
type: 134.209.183.166:6881
type: 188.134.79.161:6881
type: 101.58.64.212:6881
type: 216.128.97.44:6881
type: 114.230.238.15:6881
type: 94.180.174.67:6881
type: 77.201.81.202:6881
type: 95.161.201.38:6881
type: 159.93.117.43:6881
type: 5.128.88.71:6881
type: 213.112.241.176:6881
type: 114.253.243.135:6881
type: 178.25.198.49:6881
type: 175.203.161.152:6881
type: 187.251.215.190:6881
type: 213.174.232.178:6881
type: 110.37.38.171:6881
type: 95.52.117.149:6881
type: 135.19.153.132:6881
type: 192.227.221.84:6881
type: 115.50.156.34:6881
type: 54.194.137.170:6881
type: 18.191.2.28:6881
type: 18.188.31.0:6881
type: 84.247.141.118:6881
type: 164.68.113.202:6881
type: 104.9.174.139:6881
type: 142.171.125.191:6881
type: 213.171.209.62:6881
type: 46.236.167.18:6881
type: 86.153.145.122:6881
type: 106.104.72.204:6881
type: 84.123.121.62:6881
type: 221.146.154.182:6881
type: 54.214.105.212:6881
type: 52.9.197.152:6881
type: 144.137.135.133:6881
type: 84.155.37.87:6881
type: 87.253.94.63:6881
type: 117.30.217.206:6881
type: 173.11.114.148:6881
type: 135.181.238.57:50000
type: 65.21.128.237:50000
type: 37.27.103.253:50000
type: 135.181.227.244:50000
type: 37.27.117.251:50000
type: 88.99.145.203:50000
type: 37.27.117.113:50000
type: 135.181.227.243:50000
type: 65.21.128.246:50000
type: 65.109.112.139:50000
type: 65.21.128.245:50000
type: 37.27.117.50:50000
type: 65.21.128.221:50000
type: 65.21.129.52:50000
type: 65.21.128.244:50000
type: 65.21.125.187:50000
type: 65.21.128.214:50000
type: 65.21.128.240:50000
type: 65.21.125.186:50000
type: 37.27.103.248:50000
type: 65.21.129.49:50000
type: 37.27.119.118:50000
type: 37.27.119.120:50000
type: 37.27.119.179:50000
type: 37.27.119.187:50000
type: 37.27.107.121:50000
type: 135.181.227.253:50000
type: 65.21.125.183:50000
type: 37.27.117.250:50000
type: 65.21.125.159:50000
type: 37.27.117.249:50000
type: 135.181.238.125:50000
type: 65.21.128.225:50000
type: 65.21.129.47:50000
type: 37.27.107.61:50000
type: 65.21.129.51:50000
type: 37.27.117.48:50000
type: 65.21.128.250:50000
type: 130.239.18.158:8515
type: 178.162.174.222:28014
type: 178.162.173.219:28014
type: 213.227.152.137:28014
type: 178.162.174.149:28001
type: 178.162.174.178:28001
type: 178.162.174.220:28001
type: 5.79.122.78:28001
type: 130.239.18.158:8524
type: 178.162.174.43:28004
type: 37.48.71.221:28004
type: 91.179.255.214:6889
type: 2.233.92.106:6889
type: 93.39.218.251:6889
type: 150.249.167.121:6889
type: 1.158.175.126:6889
type: 188.234.213.50:6889
type: 176.221.157.84:51413
type: 94.190.112.28:51413
type: 198.100.145.51:51413
type: 95.211.81.107:51413
type: 194.44.45.138:51413
type: 5.79.85.198:51413
type: 185.163.124.207:51413
type: 77.37.209.202:51413
type: 193.105.124.4:51413
type: 85.166.175.80:51413
type: 188.165.235.164:51413
type: 188.165.216.84:51413
type: 89.168.69.159:51413
type: 185.107.44.197:51413
type: 158.101.13.142:51413
type: 76.20.200.167:51413
type: 138.68.229.71:51413
type: 75.240.191.114:51413
type: 115.212.205.227:51413
type: 82.36.195.155:51413
type: 5.39.87.120:51413
type: 190.102.234.99:51413
type: 109.130.174.62:51413
type: 14.216.244.163:51413
type: 23.105.207.28:51413
type: 37.157.197.103:51413
type: 151.80.32.82:51413
type: 222.0.129.136:51413
type: 81.171.3.160:51413
type: 5.35.114.10:51413
type: 195.154.233.74:6880
type: 52.70.34.253:6880
type: 52.21.231.83:6880
type: 147.135.11.99:6880
type: 45.203.207.61:6880
type: 130.239.18.158:8580
type: 72.21.17.86:27892
type: 65.108.143.34:38017
type: 130.62.133.122:32361
type: 86.16.234.23:50321
type: 189.5.81.237:50321
type: 97.96.251.223:50321
type: 195.201.179.130:16309
type: 130.239.18.158:8500
type: 66.81.186.130:2701
type: 130.239.18.158:8516
type: 178.162.173.91:28003
type: 178.162.174.169:28003
type: 178.162.173.9:28003
type: 130.239.18.158:8597
type: 130.239.18.158:8513
type: 185.21.216.161:62649
type: 112.121.170.178:17462
type: 185.149.91.167:51097
type: 185.21.217.44:50843
type: 178.162.173.167:28007
type: 178.162.173.36:28007
type: 178.162.173.232:28007
type: 37.48.95.185:50270
type: 107.189.31.229:1027
type: 177.131.28.60:1027
type: 89.149.202.17:28018
type: 46.232.210.157:64170
type: 146.70.137.18:50974
type: 178.162.174.185:28012
type: 195.154.172.179:26536
type: 185.149.91.63:51059
type: 178.162.173.161:28008
type: 178.162.173.111:28008
type: 95.168.160.123:28008
type: 23.243.135.12:30569
type: 15.204.107.67:8080
type: 45.155.90.140:8080
type: 69.50.95.40:10000
type: 193.14.193.189:51414
type: 103.140.3.8:63551
type: 185.148.0.148:22490
type: 193.23.250.90:49643
type: 178.162.174.184:28010
type: 95.211.198.95:28010
type: 125.31.93.226:34750
type: 87.119.154.97:8999
type: 51.195.220.36:8650
type: 77.239.246.35:60320
type: 185.203.56.68:62927
type: 173.179.63.93:28666
type: 210.113.127.25:40781
type: 154.38.161.205:15656
type: 202.61.205.59:62782
type: 46.232.211.204:64159
type: 46.232.211.238:64120
type: 122.150.164.103:65166
type: 95.211.160.117:28002
type: 83.94.63.221:52904
type: 185.203.56.73:10024
type: 178.162.174.70:28011
type: 95.211.198.95:28011
type: 144.76.175.153:43115
type: 183.96.206.178:7832
type: 31.208.30.138:5632
type: 121.134.163.10:53392
type: 66.56.80.26:59141
type: 210.198.245.116:1500
type: 31.208.186.32:1558
type: 137.186.214.123:52088
type: 188.165.244.171:56602
type: 213.152.186.40:51010
type: 178.246.105.65:55654
type: 84.73.238.141:63218
type: 5.135.165.11:15001
type: 49.215.47.100:30773
type: 144.76.175.153:40199
type: 186.205.16.9:19633
type: 72.194.103.57:43356
type: 94.63.92.96:48803
type: 119.206.79.94:41016
type: 99.192.40.225:34228
type: 89.143.169.197:57731
type: 1.220.160.10:7840
type: 109.153.252.30:19109
type: 65.108.143.34:56480
type: 45.87.251.165:54736
type: 192.46.223.91:36881
type: 178.162.174.230:28015
type: 68.191.149.87:55341
type: 189.103.232.125:6883
type: 203.234.218.166:8135
type: 81.171.6.81:17417
type: 46.11.199.49:53277
type: 185.234.67.247:50455
type: 185.219.178.148:57656
type: 15.235.208.228:30682
type: 67.253.5.63:40680
type: 172.101.140.176:14405
type: 183.83.167.11:35296
type: 169.224.125.200:60718
type: 103.212.117.149:22554
type: 103.177.27.83:12879
type: 45.164.96.202:15030
type: 37.6.236.231:25771
type: 189.6.236.231:16796
type: 95.217.33.172:55183
type: 87.252.191.91:39917
type: 61.80.135.129:32885
type: 38.134.41.130:32681
type: 152.53.52.107:10240
type: 194.29.101.83:10240
type: 152.53.104.128:10240
type: 54.77.218.23:6992
type: 54.209.131.199:6992
type: 125.237.193.252:61137
type: 54.39.52.64:48853
type: 185.203.56.44:14466
type: 54.39.52.64:29129
type: 185.203.56.59:16107
type: 45.152.210.158:50171
type: 65.108.143.34:43113
type: 185.149.91.33:51025
type: 60.36.89.171:19928
type: 81.171.6.43:28006
type: 79.127.235.177:64106
type: 89.134.2.191:18045
type: 149.22.94.16:39265
type: 119.201.163.88:40982
type: 77.81.142.122:53672
type: 73.242.195.115:56734
type: 188.165.226.154:33333
type: 62.210.200.2:36149
type: 162.251.63.78:10048
type: 172.111.38.128:26044
type: 185.107.68.219:35539
type: 162.251.63.78:10017
type: 69.50.95.40:10076
type: 172.111.38.128:26092
type: 39.48.170.48:38056
type: 93.44.110.204:41562
type: 195.154.172.179:22552
type: 179.38.191.217:37271
type: 138.124.127.102:44327
type: 183.178.255.182:17020
type: 77.38.139.174:54986
type: 197.94.212.18:23225
type: 77.28.210.216:55525
type: 118.232.21.175:25810
type: 99.66.197.99:46443
type: 149.56.27.121:28351
type: 80.99.43.140:9500
type: 46.232.211.163:64152
type: 185.203.56.58:63825
type: 37.157.194.190:6885
type: 188.165.231.77:56991
type: 185.247.159.103:10108
type: 122.107.179.165:43793
type: 45.87.251.149:28023
type: 217.119.77.26:27220
type: 62.210.200.6:34995

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f8f65962-1aef-44f2-814a-d9a0edf84e0c

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b93b5ee0-84c5-4716-b5b3-90c1da9a34e8

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a/

Verdict:

Malicious

Threat:

Linux.Trojan.Multiverze

Link:

https://tip.neiki.dev/file/f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2025-07-13 05:21:14 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6f6nih4fsmo3hp622wrafawgsjdcposbpb3wewq5yupoco4ebgna._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250713-f12ecaxyfw/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a5f21188-2bef-48dc-ac44-3624a485747d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf f17cd41f85931db3bfdad5a20282c6924627ba417877625a1dc51ee13b84099a

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558166/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample