MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95
SHA3-384 hash:	b9009f2e677ac39e1b3b93e1488eb2298b0f4a45530afebeecd3f03b47e4aba18e407190a1a861cfb20ed2dc88b1d8f4
SHA1 hash:	624ee5f6bf0785b9c351fe427b49b21cf8b7f400
MD5 hash:	a481d57daff931eb606b1ec93a2fd443
humanhash:	london-kentucky-hamper-illinois
File name:	aarch64
Download:	download sample
File size:	509'896 bytes
First seen:	2025-06-16 23:04:59 UTC
Last seen:	2025-06-17 06:21:13 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
TLSH	T187B41228EE4E38C1F3D1E378DA0A4BB2B05B79D0C166C1B2BA41E25D95EDDDEC5D0212
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Siggen.9163.6109.22008.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6850a3548bd5d68a12e90754linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates directories

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

false

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

34420

Full report:

https://elfdigest.com/brief/f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 197.36.188.124:6881
type: 192.198.60.53:6881
type: 201.238.125.46:6881
type: 67.215.246.10:6881
type: 24.212.167.6:6881
type: 83.24.222.43:6881
type: 84.227.77.72:6881
type: 80.108.40.67:6881
type: 95.221.116.144:6881
type: 181.44.230.160:6881
type: 24.200.72.107:6881
type: 89.222.177.53:6881
type: 157.180.11.254:6881
type: 75.63.122.121:6881
type: 138.97.142.245:6881
type: 81.106.238.162:6881
type: 36.231.132.104:6881
type: 82.1.194.191:6881
type: 190.112.14.199:6881
type: 181.46.195.20:6881
type: 108.84.68.121:6881
type: 192.227.221.84:6881
type: 99.19.112.171:6881
type: 52.9.197.152:6881
type: 18.190.61.127:6881
type: 54.214.62.55:6881
type: 91.199.149.77:6881
type: 188.159.228.27:6881
type: 190.46.63.131:6881
type: 82.218.103.194:6881
type: 46.232.211.130:16609
type: 45.203.155.80:6880
type: 34.228.34.186:6880
type: 52.71.188.191:6880
type: 3.19.152.158:6880
type: 65.21.33.212:50000
type: 37.27.119.253:50000
type: 178.63.85.238:50000
type: 135.181.227.243:50000
type: 37.27.117.113:50000
type: 116.202.163.99:50000
type: 65.21.125.167:50000
type: 65.21.129.62:50000
type: 178.162.174.222:28014
type: 178.162.173.89:28014
type: 178.162.174.178:28003
type: 85.17.12.165:28003
type: 185.21.216.136:56810
type: 119.247.65.109:51413
type: 45.87.250.192:51413
type: 91.2.145.182:51413
type: 62.38.110.175:51413
type: 109.74.196.88:51413
type: 84.112.194.206:51413
type: 1.158.137.52:51413
type: 135.125.74.176:51413
type: 45.80.168.154:51413
type: 106.243.64.6:51413
type: 77.220.52.88:51413
type: 92.149.166.174:51413
type: 58.176.50.201:25351
type: 130.239.18.158:8524
type: 147.135.4.9:6886
type: 178.162.174.239:28015
type: 45.8.125.77:32183
type: 192.151.146.170:24479
type: 95.211.247.101:28009
type: 90.241.158.155:50716
type: 178.162.173.138:28004
type: 178.162.173.107:28006
type: 213.149.165.10:64203
type: 84.107.32.228:60357
type: 85.17.170.48:28010
type: 37.48.111.149:47926
type: 217.23.1.103:6891
type: 178.162.174.6:28007
type: 222.118.108.7:58531
type: 86.145.75.97:6882
type: 54.70.28.180:6882
type: 142.215.167.167:6882
type: 61.227.31.172:17309
type: 111.118.32.147:33013
type: 39.72.248.39:15000
type: 166.111.224.100:15000
type: 36.154.171.42:15000
type: 114.222.24.44:15000
type: 24.202.251.118:51787
type: 210.121.125.132:33065
type: 176.48.88.130:56908
type: 119.199.158.58:53133
type: 78.36.72.62:42823
type: 200.28.251.52:51444
type: 88.204.193.16:56132
type: 176.49.145.246:58847
type: 212.32.244.67:51215
type: 84.50.223.179:33066
type: 89.134.26.3:10843
type: 24.36.94.225:37609
type: 178.162.173.49:28013
type: 211.228.99.246:51696
type: 195.154.185.217:24397
type: 112.186.57.15:32915
type: 178.61.224.111:19137
type: 220.90.180.159:33077
type: 5.79.83.114:28001
type: 158.174.233.192:15547
type: 82.154.40.177:13512
type: 222.119.7.246:31915
type: 115.128.60.237:27902
type: 92.248.184.74:32902
type: 112.141.107.192:32839
type: 118.38.249.37:7827
type: 51.38.81.122:8649
type: 118.93.113.119:53587
type: 45.190.4.152:49841
type: 95.26.2.108:22647
type: 14.35.159.115:33135
type: 137.175.231.8:48181
type: 125.132.94.64:63749
type: 112.162.68.28:41159
type: 120.150.139.9:6889
type: 109.229.142.88:6889
type: 187.250.164.90:50936
type: 109.159.120.217:48062
type: 192.228.158.225:42673
type: 45.177.209.207:9891
type: 91.4.158.215:50549
type: 200.52.30.225:32032
type: 88.97.218.142:47294
type: 161.230.110.163:48365
type: 37.27.113.233:42333
type: 54.152.159.188:49171
type: 190.213.219.13:34887
type: 95.167.254.160:49001
type: 79.140.252.222:49001
type: 182.48.203.19:51414
type: 175.194.104.124:8055
type: 78.191.253.30:39666
type: 82.3.4.166:65274
type: 94.188.116.209:32000
type: 178.44.44.207:20765
type: 94.62.230.131:44284
type: 160.119.6.139:41547
type: 182.232.115.88:57670
type: 84.240.22.246:21458
type: 95.214.53.172:1688
type: 177.89.231.109:19679
type: 176.101.1.223:2404
type: 194.29.101.83:10240
type: 152.53.52.107:10240
type: 195.170.172.38:10240
type: 154.80.14.199:48146
type: 191.95.161.186:47803
type: 188.165.231.77:54449
type: 38.40.98.253:50309
type: 54.209.131.199:6992
type: 208.87.240.21:11162
type: 51.15.19.75:48798
type: 194.9.232.197:14082
type: 152.53.45.107:7145
type: 86.61.55.192:52977
type: 168.70.93.131:12409
type: 185.203.56.65:25000
type: 212.104.103.187:34658
type: 90.177.1.150:27294
type: 156.146.62.151:43540
type: 178.68.94.118:53090
type: 14.35.85.28:7935
type: 14.48.144.153:32562
type: 1.246.142.90:49191
type: 222.100.135.23:32559
type: 190.248.208.14:40958
type: 62.250.62.184:46504
type: 185.149.91.45:20041
type: 178.162.173.172:28012
type: 213.194.155.165:60143
type: 185.21.217.5:64194
type: 203.218.213.245:9068
type: 76.71.206.218:51799
type: 142.181.87.154:10101
type: 188.254.110.69:3329
type: 62.93.178.163:47358
type: 70.80.18.122:30881
type: 62.250.110.148:11771
type: 102.217.37.184:58830
type: 176.31.183.98:18209

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cfa8c0d5-d7f1-4988-9f45-d2664ea98896

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5430812b-50dc-4a78-8108-239838ff9648

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-16 23:05:52 UTC

File Type:

ELF64 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7h5jzqkpwxla5fxbbr6hcdlomwniouefztx6sws2ccqz7lrrdskq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250616-227hmsynw5/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3be93c87-60fe-4308-84d6-8c485e52e18d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf f9fa9cc14fb5d60e96e10c7c710d6e659a875085ccefe95a5a10a19fae311c95

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558161/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample