MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869
SHA3-384 hash:	ffb92f2db42a151cecc97ad8ec99d44ab6178ad4b7e2ee947ee8a371cbc3b20f7b3060573b2592195dba645b4964d19e
SHA1 hash:	0cf4daaa10127421a8aba6be9d8c6089f087195a
MD5 hash:	6f58eb8112fbb996a861d759ee06f567
humanhash:	beryllium-may-jupiter-wyoming
File name:	mips
Download:	download sample
File size:	592'688 bytes
First seen:	2025-07-05 16:45:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zp:W7v+mrY2xzf03yvZ/YIJ
TLSH	T128C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9
telfhash	t10ab0011070740bb84308e12d5cdcae5679f20cc3fe470c27db6047a159b54434d00d18
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686956b3c9eb97473766a816linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Opens a port

Changes access rights for a written file

Sends data to a server

Creating a file

Receives data from a server

Changes the time when the file was created, accessed, or modified

Creates directories

Launching a process

Connection attempt

DNS request

Locks files

Creating a process from a recently created file

Runs as daemon

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

exploit gcc

Link:

https://www.filescan.io/uploads/686956c39db85bde254c136b/reports/ea69d834-133a-438e-ac0d-508061fa85e5/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.123:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 93.51.75.187:6881
type: 121.200.8.89:6881
type: 195.138.67.124:6881
type: 213.171.43.155:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 79.105.132.1:6881
type: 158.69.26.229:6881
type: 84.255.203.111:6881
type: 213.65.186.172:6881
type: 64.23.178.23:6881
type: 91.43.125.226:6881
type: 195.18.18.136:6881
type: 185.183.32.124:6881
type: 70.71.249.93:6881
type: 176.109.24.126:6881
type: 73.208.41.226:6881
type: 202.88.199.9:6881
type: 5.167.70.229:6881
type: 175.198.74.167:6881
type: 86.162.220.196:6881
type: 5.79.67.10:6881
type: 210.6.133.95:6881
type: 90.3.32.31:6881
type: 189.4.81.145:6881
type: 175.9.162.19:6881
type: 62.178.175.59:6881
type: 18.223.137.220:6881
type: 54.194.137.170:6881
type: 54.214.62.55:6881
type: 180.224.17.27:6881
type: 84.247.141.118:6881
type: 54.194.124.68:6881
type: 58.96.66.146:6881
type: 73.53.182.247:6881
type: 188.90.169.20:51413
type: 162.19.243.205:51413
type: 77.81.174.65:51413
type: 200.26.188.219:51413
type: 73.112.62.55:51413
type: 83.239.58.206:51413
type: 178.32.222.82:51413
type: 176.20.143.241:51413
type: 156.146.48.154:51413
type: 51.158.153.124:51413
type: 181.12.115.235:51413
type: 37.28.155.145:51413
type: 37.187.140.181:51413
type: 79.238.119.15:51413
type: 109.111.79.192:51413
type: 124.154.55.200:51413
type: 172.111.38.128:26017
type: 130.239.18.158:8521
type: 126.79.120.14:6889
type: 86.178.29.243:6889
type: 212.14.105.244:6889
type: 89.153.101.188:6889
type: 171.7.1.222:57700
type: 112.70.115.48:24764
type: 217.121.231.94:59625
type: 130.239.18.158:8525
type: 45.150.144.244:34721
type: 130.239.18.158:8508
type: 185.203.56.69:12282
type: 135.181.238.57:50000
type: 162.55.85.86:50000
type: 144.76.108.135:50000
type: 5.9.43.195:50000
type: 162.55.85.174:50000
type: 162.55.82.87:50000
type: 162.55.81.153:50000
type: 162.55.85.173:50000
type: 65.21.129.60:50000
type: 135.181.227.244:50000
type: 37.27.104.57:50000
type: 37.27.119.249:50000
type: 65.21.128.220:50000
type: 116.210.20.57:50000
type: 162.55.81.219:50000
type: 162.55.82.120:50000
type: 130.239.18.158:8597
type: 178.162.173.159:28012
type: 85.17.170.48:28012
type: 178.162.174.2:28002
type: 178.162.173.20:28002
type: 178.162.174.149:28002
type: 178.162.174.210:28002
type: 195.154.233.74:6880
type: 3.15.85.168:6880
type: 173.230.130.111:6880
type: 3.138.130.148:6880
type: 45.203.206.54:6880
type: 95.211.174.117:54546
type: 95.168.162.161:42670
type: 122.150.166.176:52600
type: 178.162.173.207:28009
type: 178.162.173.134:28009
type: 178.162.174.165:28003
type: 178.162.173.56:28003
type: 178.162.173.91:28003
type: 178.162.174.178:28003
type: 178.162.173.75:28013
type: 95.211.175.145:8151
type: 82.16.34.246:55113
type: 62.210.201.217:8642
type: 89.149.200.92:28020
type: 130.239.18.158:8500
type: 130.239.18.158:8507
type: 49.169.189.63:7896
type: 162.251.63.120:10067
type: 46.122.1.198:49349
type: 89.149.222.197:57959
type: 130.239.18.158:8537
type: 78.47.84.104:22223
type: 45.87.251.6:28001
type: 178.162.174.149:28001
type: 178.162.173.231:28001
type: 178.162.173.105:28001
type: 86.1.242.242:54398
type: 130.239.18.158:8510
type: 46.232.210.29:63353
type: 46.232.210.119:64100
type: 178.162.174.222:28014
type: 5.79.80.223:28014
type: 178.162.174.43:28004
type: 178.162.173.201:28004
type: 130.239.18.158:8524
type: 130.239.18.158:8515
type: 130.239.18.158:8580
type: 130.239.18.158:8516
type: 130.239.18.158:8513
type: 178.162.174.173:28016
type: 95.211.198.95:28016
type: 130.239.18.158:8539
type: 46.232.211.220:25359
type: 146.56.102.98:56881
type: 95.168.168.222:49419
type: 46.232.210.229:17009
type: 61.64.25.32:42939
type: 69.50.95.40:10025
type: 23.158.56.120:10079
type: 69.50.95.40:10012
type: 69.50.95.40:12092
type: 23.158.56.120:14081
type: 45.91.208.117:52278
type: 195.154.178.158:8672
type: 103.31.119.10:56085
type: 81.171.17.69:49839
type: 23.158.56.120:16003
type: 69.50.95.40:12008
type: 178.162.173.199:28011
type: 92.203.14.98:24431
type: 45.87.251.11:28127
type: 146.70.198.24:47796
type: 178.162.173.169:28010
type: 178.162.173.222:28010
type: 110.1.100.187:57089
type: 185.21.216.154:56480
type: 88.198.62.227:63696
type: 37.48.118.38:28007
type: 88.97.240.61:1315
type: 178.162.173.228:28005
type: 62.212.81.227:28005
type: 195.154.176.26:8678
type: 61.78.237.219:40946
type: 110.144.194.143:33873
type: 106.168.97.147:58673
type: 176.10.148.76:56029
type: 46.147.248.200:6882
type: 54.194.137.170:6882
type: 220.127.18.227:7848
type: 183.97.254.7:41049
type: 144.76.175.153:41513
type: 86.49.239.182:7410
type: 74.123.17.187:54764
type: 5.79.77.56:61030
type: 85.254.18.157:39123
type: 5.79.79.137:42253
type: 37.6.3.186:4633
type: 78.44.122.242:63168
type: 178.162.174.53:28008
type: 95.211.198.95:28008
type: 78.170.80.219:45474
type: 182.232.92.178:6750
type: 185.203.56.73:58040
type: 176.63.12.220:49834
type: 5.39.85.86:56038
type: 185.21.217.21:51378
type: 210.103.110.67:7674
type: 46.232.211.89:64088
type: 88.233.86.67:44485
type: 218.156.232.201:32905
type: 124.123.105.91:48812
type: 27.85.0.183:6888
type: 198.53.81.162:18841
type: 176.88.122.139:5169
type: 62.210.204.44:31266
type: 81.110.175.67:60147
type: 217.162.126.2:49001
type: 81.23.164.165:49001
type: 188.0.189.89:49001
type: 111.220.207.233:49001
type: 178.217.166.208:1845
type: 126.117.45.151:8933
type: 73.140.48.241:14901
type: 185.149.91.31:51035
type: 153.228.187.209:58929
type: 185.157.244.161:50203
type: 2.11.247.21:15987
type: 220.118.82.235:33107
type: 181.43.96.231:55555
type: 69.176.165.48:47044
type: 204.8.84.45:25504
type: 185.21.217.55:60115
type: 216.98.214.21:1622
type: 185.148.1.163:36231
type: 70.51.79.30:50321
type: 74.206.33.110:53218
type: 185.248.160.26:51793
type: 61.6.56.100:9010
type: 71.194.203.62:51030
type: 175.206.228.46:40775
type: 122.150.151.204:21866
type: 146.158.35.141:21992
type: 222.8.184.250:19927
type: 91.93.235.196:12288
type: 144.76.175.153:34458
type: 91.184.119.208:9537
type: 184.162.95.145:64420
type: 13.114.205.93:6992
type: 54.194.135.233:6992
type: 186.158.16.25:8747
type: 78.190.16.25:51885
type: 78.142.231.133:6767
type: 43.130.56.223:6000
type: 54.39.107.165:16481
type: 88.118.172.199:51823
type: 186.189.74.48:42964
type: 211.232.245.74:7465
type: 37.48.95.50:48996
type: 185.21.217.55:55201
type: 121.141.141.15:40841
type: 72.21.17.24:53120
type: 220.127.219.130:40733
type: 58.127.207.188:33191
type: 222.113.145.228:7949
type: 170.82.76.200:28251
type: 76.176.222.186:37947
type: 191.240.168.3:32971
type: 170.81.237.85:33124
type: 88.168.103.228:12062
type: 220.79.160.191:15342
type: 89.47.234.26:33424
type: 24.9.219.228:53915
type: 76.133.184.190:11479

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/29359d2b-c0c3-4219-b44d-1bdb8b8f8524

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/beb79eee-958f-48dc-956c-7c878460f86e

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869/

Threat name:

Linux.Dropper.Multiverze

Status:

Malicious

First seen:

2025-07-05 16:45:35 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7h5vggw22f6srnaqpaigbwobgpqddtkhkacgwcvbzhltvnhkjbuq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250705-t9nrha1qs2/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8861ea3e-15e0-4154-8fa0-d76b121803bb

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf f9fb531adad17d28b410781060d9c133e031cd4750046b0aa1c9d73ab4ea4869

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558223/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample