🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8
SHA3-384 hash: e5938a83829a7379c552f22e6c381624bcda1d6559c4e08cab91b8e5b661bedb2054cf1c4adb9cc81a36e368750f41e9
SHA1 hash: f116e70f5cc43b6fb10771d1bc3f144618bbf5d6
MD5 hash: a29a067ba419a8055519fcad24b2c5e3
humanhash: quiet-johnny-missouri-king
File name:mips
Download: download sample
File size:592'688 bytes
First seen:2025-07-13 00:50:53 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zo:W7v+mrY2xzf03yvZ/YII
TLSH T197C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
14
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68730302c9eb97473768a586linux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creates directories
Locks files
Changes access rights for a written file
Changes the time when the file was created, accessed, or modified
Receives data from a server
Creating a file
Runs as daemon
Connection attempt
Opens a port
Launching a process
Sends data to a server
Creating a process from a recently created file
Creates or modifies files in /cron to set up autorun
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
exploit gcc lolbin packed remote
Link:
https://www.filescan.io/uploads/687303011bf7248a928a0b33/reports/dcd70542-958b-4fb6-9e02-a91252ed9774/overview
Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
true
Architecture:
mips
Packer:
custom
Botnet:
unknown
Number of open files:
60
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8
Behaviour
Anti-VM
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 46.0.52.88:6881
type: 86.130.32.26:6881
type: 76.224.17.222:6881
type: 46.116.179.156:6881
type: 78.63.240.28:6881
type: 89.179.246.14:6881
type: 73.208.41.226:6881
type: 5.101.195.120:6881
type: 3.92.204.118:6881
type: 84.28.2.133:6881
type: 178.22.197.239:6881
type: 78.71.194.48:6881
type: 109.225.23.22:6881
type: 94.26.54.254:6881
type: 212.120.242.140:6881
type: 70.177.19.251:6881
type: 45.248.145.85:6881
type: 54.214.105.212:6881
type: 71.73.46.129:6881
type: 185.42.60.252:6881
type: 203.198.34.4:6881
type: 109.182.157.69:6881
type: 54.70.28.180:6881
type: 82.54.3.134:6881
type: 178.64.150.93:6881
type: 200.36.211.53:6881
type: 197.249.87.215:6881
type: 85.135.154.0:6881
type: 62.209.220.45:6881
type: 148.135.106.206:6881
type: 220.119.215.207:6881
type: 18.191.2.28:6881
type: 13.58.27.33:6881
type: 35.155.156.153:6881
type: 221.161.227.150:6881
type: 85.225.99.150:6881
type: 71.217.64.232:6881
type: 172.10.127.154:6881
type: 124.246.70.102:6881
type: 31.130.248.52:6881
type: 145.239.10.78:6881
type: 80.201.212.205:6881
type: 130.239.18.158:8516
type: 148.153.188.242:6880
type: 45.203.153.93:6880
type: 34.197.35.250:6880
type: 45.203.154.67:6880
type: 195.154.233.74:6880
type: 178.162.173.91:28003
type: 178.162.174.185:28003
type: 178.162.173.32:28003
type: 178.162.174.23:28003
type: 178.162.173.90:28003
type: 130.239.18.158:8597
type: 140.245.76.181:9081
type: 178.162.174.181:28010
type: 178.162.173.12:28010
type: 178.162.174.8:28010
type: 178.162.174.21:28010
type: 76.21.54.199:53795
type: 178.162.173.204:28004
type: 178.162.174.43:28004
type: 178.162.174.93:28004
type: 178.162.173.149:28004
type: 178.162.173.138:28004
type: 198.100.145.51:51413
type: 86.10.253.166:51413
type: 120.204.233.226:51413
type: 85.17.172.94:51413
type: 77.37.144.14:51413
type: 188.90.169.20:51413
type: 203.211.113.180:51413
type: 107.219.195.28:51413
type: 51.77.118.60:51413
type: 111.193.226.50:51413
type: 45.136.230.52:51413
type: 45.12.215.143:51413
type: 204.27.56.10:51413
type: 187.236.106.38:51413
type: 151.192.183.73:51413
type: 194.44.237.46:51413
type: 187.14.159.8:51413
type: 218.161.20.100:51413
type: 84.197.212.148:51413
type: 167.71.129.218:51413
type: 37.59.41.14:51413
type: 90.154.56.106:51413
type: 216.165.231.147:51413
type: 178.162.174.147:28012
type: 178.162.174.168:28012
type: 178.162.174.231:28012
type: 178.162.174.210:28014
type: 178.162.174.222:28014
type: 178.162.174.88:28014
type: 178.162.173.142:28014
type: 45.87.251.11:28127
type: 8.30.96.11:45779
type: 189.219.122.79:44887
type: 45.164.103.79:53453
type: 185.74.52.19:2810
type: 95.91.244.19:8294
type: 200.125.120.144:38254
type: 203.232.84.233:18202
type: 70.52.55.239:54170
type: 59.97.144.123:8000
type: 5.194.92.226:46527
type: 178.162.174.82:28007
type: 178.162.173.167:28007
type: 178.162.174.208:28007
type: 178.162.174.85:28007
type: 178.162.174.120:28007
type: 178.162.173.70:28007
type: 185.149.91.33:51023
type: 78.83.64.26:15412
type: 175.206.110.56:8198
type: 51.75.163.151:8643
type: 46.232.211.100:15409
type: 72.21.17.18:30615
type: 142.115.29.78:6889
type: 112.91.94.43:6889
type: 125.229.145.57:6889
type: 209.122.33.173:6887
type: 38.55.71.212:41041
type: 189.203.98.254:13559
type: 188.165.244.171:59254
type: 195.154.172.179:24024
type: 46.232.211.100:17559
type: 146.70.137.18:54321
type: 69.50.95.40:12066
type: 178.162.174.85:28001
type: 178.162.174.149:28001
type: 178.162.173.169:28001
type: 178.162.174.8:28001
type: 69.87.207.133:16630
type: 23.162.56.55:24032
type: 188.165.240.82:8135
type: 178.162.173.208:28013
type: 85.114.193.81:48501
type: 95.211.218.207:28015
type: 178.162.174.103:28008
type: 178.162.173.76:28008
type: 104.195.12.43:57299
type: 5.135.156.163:56843
type: 185.149.91.21:51118
type: 130.239.18.158:8520
type: 212.7.202.40:28030
type: 135.181.227.244:50000
type: 135.181.238.57:50000
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 80.254.102.47:5775
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8644
type: 51.195.223.60:8644
type: 130.239.18.158:8521
type: 178.162.173.24:28009
type: 130.239.18.158:8603
type: 46.232.211.180:51539
type: 58.141.80.19:41164
type: 107.190.30.184:19331
type: 130.239.18.158:8580
type: 130.239.18.158:8513
type: 175.125.183.228:41038
type: 178.32.217.107:1026
type: 46.232.211.220:19709
type: 123.194.40.44:41170
type: 181.117.10.46:60733
type: 45.152.210.7:51160
type: 121.163.150.180:7652
type: 218.156.119.168:19761
type: 60.246.127.133:15097
type: 57.129.45.78:8658
type: 122.199.59.90:48888
type: 74.78.87.212:34144
type: 83.99.214.85:55994
type: 181.117.9.178:48280
type: 176.63.6.36:24277
type: 82.77.172.236:43939
type: 186.22.196.220:62635
type: 78.96.81.7:9449
type: 138.0.23.34:50460
type: 121.150.238.217:46783
type: 183.96.168.14:33106
type: 107.172.180.130:29191
type: 37.48.89.230:55271
type: 176.205.32.49:18285
type: 51.186.118.80:30319
type: 46.53.133.159:3500
type: 24.27.55.9:56321
type: 189.157.144.153:53979
type: 109.87.126.244:35747
type: 192.169.116.182:60020
type: 43.134.160.243:60020
type: 211.35.179.119:7947
type: 72.220.229.151:6894
type: 176.122.50.175:3355
type: 88.97.205.189:5387
type: 59.28.209.110:40827
type: 70.190.122.242:9087
type: 144.76.175.153:54094
type: 185.21.216.192:64797
type: 5.189.138.163:60070
type: 176.63.21.41:5101
type: 186.219.102.230:41545
type: 179.220.216.207:52153
type: 85.145.92.186:33108
type: 178.207.100.14:55077
type: 93.41.67.68:63707
type: 71.208.99.76:54335
type: 93.159.22.159:26122
type: 177.152.124.223:9051
type: 183.106.27.100:43140
type: 176.58.225.152:10753
type: 54.39.52.183:14497
type: 88.127.174.187:48145
type: 185.149.91.177:20019
type: 178.162.174.138:28006
type: 178.162.173.104:28006
type: 178.221.69.190:20000
type: 191.162.75.46:31784
type: 95.211.20.1:15148
type: 168.232.241.16:12322
type: 121.163.238.206:40969
type: 211.226.233.28:7942
type: 211.228.122.226:32748
type: 61.77.69.59:40885
type: 129.122.224.220:64677
type: 179.6.1.134:26639
type: 197.88.240.126:45589
type: 120.28.234.65:22163
type: 178.162.173.56:28000
type: 206.248.98.28:57590
type: 95.214.53.172:1688
type: 125.248.16.146:38522
type: 195.170.172.38:10240
type: 152.53.52.107:10240
type: 137.74.95.127:31452
type: 152.53.45.107:7033
type: 185.230.223.120:48563
type: 162.251.63.120:10043
type: 58.234.86.134:32734
type: 188.83.107.242:54668
type: 5.79.67.8:41286
type: 152.53.45.107:7239
type: 144.64.208.3:53890
type: 89.149.202.3:28075
type: 89.134.5.118:12678
type: 94.69.214.26:24205
type: 185.203.56.72:29976
type: 85.214.40.71:54220
type: 5.194.189.221:41414
type: 142.189.109.26:65000
type: 188.165.244.171:54259
type: 102.165.160.243:55608
type: 73.148.113.183:52727
type: 137.175.44.26:17347
type: 124.213.189.11:9995
type: 59.7.131.105:40998
type: 81.201.59.85:51386
type: 110.66.219.75:34806
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/044eb79c-1238-4d3c-a5f6-ffdf9c2796a6
Behavior Graph:
Download SVG
%3 guuid=d14b2944-1a00-0000-33ef-b336a60a0000 pid=2726 /usr/bin/sudo guuid=70de6047-1a00-0000-33ef-b336af0a0000 pid=2735 /tmp/sample.bin guuid=d14b2944-1a00-0000-33ef-b336a60a0000 pid=2726->guuid=70de6047-1a00-0000-33ef-b336af0a0000 pid=2735 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/065c9d7b-819a-4543-8b5e-8d0ec12e92a6
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.spyw
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1735017
Signature
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample scans a subnet
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1735017 Sample: mips.elf Startdate: 13/07/2025 Architecture: LINUX Score: 72 38 178.162.174.169, 28016, 6881 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 2->38 40 178.162.174.173, 28016, 6881 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 2->40 42 102 other IPs or domains 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Connects to many ports of the same IP (likely port scanning) 2->46 48 Sample scans a subnet 2->48 10 mips.elf configuration 2->10         started        signatures3 process4 process5 12 mips.elf sh 10->12         started        14 configuration 10->14         started        17 mips.elf sh 10->17         started        signatures6 19 sh crontab 12->19         started        23 sh 12->23         started        56 Opens /sys/class/net/* files useful for querying network interface information 14->56 58 Sample reads /proc/mounts (often used for finding a writable filesystem) 14->58 25 configuration 14->25         started        27 sh crontab 17->27         started        process7 file8 36 /var/spool/cron/crontabs/tmp.YsKMFA, ASCII 19->36 dropped 50 Sample tries to persist itself using cron 19->50 52 Executes the "crontab" command typically for achieving persistence 19->52 29 sh crontab 23->29         started        32 configuration 25->32         started        signatures9 process10 signatures11 54 Executes the "crontab" command typically for achieving persistence 29->54 34 configuration 32->34         started        process12
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8/
Threat name:
Linux.Dropper.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-07-13 00:51:09 UTC
File Type:
ELF32 Big (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rx44jx3tellafmgikagtn5ci3k65kvclbiqlmlyav5puz4est4a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/250713-a7hmxswzbz/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Checks hardware identifiers (DMI)
Creates/modifies Cron job
Enumerates running processes
Reads MAC address of network interface
Reads hardware information
Renames itself
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b4d3b134-8403-4aae-9b5a-e7203399f529
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf f46fce26fb9916b01586428069b7a246d5eeaaa2585105b178057afa678494f8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3558165/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments