MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54
SHA3-384 hash:	4ed3018c25b31d20bf0fe88a9cfee50b252027760329c6783a14ba95a436c8526e5ae72ebf5e80a7057e0da059ec925e
SHA1 hash:	9f6489fff116ceaed7870380370f28bc603b48e7
MD5 hash:	2e5fc8d5ddf7750ccbe10ab8d63298a8
humanhash:	charlie-floor-mexico-helium
File name:	arm926t
Download:	download sample
File size:	480'792 bytes
First seen:	2025-06-30 16:35:44 UTC
Last seen:	2025-07-01 03:47:08 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
TLSH	T110A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800
telfhash	t186c08c8c0fd401beba7d72a203bef2bf61a072f0be0224920404eb6f074c584028144c
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32055.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32057.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.32058.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Siggen.9148.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6862bd1e37c343677947de97linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a file in the %temp% directory

Creates directories

Sends data to a server

Creating a process from a recently created file

Changes the time when the file was created, accessed, or modified

Locks files

Collects information on the CPU

Connection attempt

Changes access rights for a written file

Launching a process

Opens a port

Runs as daemon

Receives data from a server

DNS request

Creates or modifies files in /cron to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

exploit gcc lolbin remote

Link:

https://www.filescan.io/uploads/6862bd0fbf2a41982c803a4c/reports/d3b75fef-2b24-4495-8573-b5c393a5ba9d/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

arm

Packer:

custom

Botnet:

unknown

Number of open files:

103

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54

Behaviour

Anti-VM

Persistence

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 162.159.200.1:123
type: 130.239.18.158:6881
type: 67.215.246.10:6881
type: 178.69.209.93:6881
type: 91.7.75.78:6881
type: 73.208.41.226:6881
type: 212.156.245.134:6881
type: 212.83.150.167:6881
type: 176.125.139.123:6881
type: 89.207.71.47:6881
type: 188.42.55.92:6881
type: 188.89.139.191:6881
type: 159.65.34.10:6881
type: 95.189.211.128:6881
type: 31.135.103.90:6881
type: 92.125.15.28:6881
type: 1.245.241.226:6881
type: 202.169.99.242:6881
type: 103.247.28.49:6881
type: 18.190.61.127:6881
type: 192.227.221.84:6881
type: 110.235.228.253:6881
type: 110.141.237.170:6881
type: 70.27.19.69:6881
type: 107.220.207.35:6881
type: 222.70.161.158:6881
type: 46.160.248.47:6881
type: 167.99.72.189:6881
type: 119.28.68.97:6881
type: 76.104.46.3:6881
type: 142.171.214.89:6881
type: 82.73.71.65:6881
type: 76.21.231.131:6881
type: 83.246.182.19:6881
type: 80.15.200.68:6881
type: 178.162.174.222:28014
type: 5.79.80.223:28014
type: 178.162.173.76:28014
type: 178.162.174.82:28014
type: 178.162.174.46:28014
type: 88.198.230.221:49668
type: 178.162.174.43:28004
type: 130.239.18.158:8524
type: 135.181.238.57:50000
type: 37.27.119.253:50000
type: 148.251.13.100:50000
type: 37.27.117.253:50000
type: 37.27.107.117:50000
type: 37.27.104.50:50000
type: 37.27.120.59:50000
type: 37.27.119.118:50000
type: 135.181.238.125:50000
type: 65.21.125.166:50000
type: 37.27.119.190:50000
type: 37.27.117.180:50000
type: 167.235.10.94:50000
type: 65.21.129.56:50000
type: 135.181.223.81:50000
type: 135.181.227.244:50000
type: 65.21.125.184:50000
type: 37.27.119.241:50000
type: 5.135.165.33:6331
type: 185.203.56.38:61855
type: 79.106.231.163:1434
type: 96.92.220.25:51413
type: 83.32.86.217:51413
type: 89.23.32.102:51413
type: 212.251.201.227:51413
type: 188.90.169.20:51413
type: 85.140.112.179:51413
type: 5.135.163.217:51413
type: 5.135.155.133:51413
type: 178.70.30.2:51413
type: 51.158.148.75:51413
type: 93.89.141.246:51413
type: 51.159.53.128:51413
type: 188.32.6.38:51413
type: 62.210.38.210:51413
type: 86.84.170.58:51413
type: 111.220.188.247:51413
type: 185.189.102.176:51413
type: 37.187.114.44:51413
type: 42.4.233.241:51413
type: 178.38.224.238:51413
type: 176.31.119.149:51413
type: 130.239.18.158:8515
type: 172.111.38.128:26075
type: 164.132.162.3:57501
type: 213.227.151.25:28013
type: 178.162.174.132:28013
type: 95.211.247.101:28013
type: 185.21.216.185:60731
type: 5.39.85.82:55428
type: 23.158.56.119:10075
type: 185.203.56.50:61573
type: 103.199.200.235:2121
type: 45.87.251.11:28127
type: 217.121.231.94:59625
type: 130.239.18.158:8508
type: 130.239.18.158:8521
type: 105.216.98.167:35344
type: 45.155.90.234:12538
type: 93.183.146.188:10259
type: 178.162.174.98:28012
type: 185.203.56.59:58006
type: 114.18.222.169:15988
type: 95.168.162.161:42670
type: 178.162.173.231:28001
type: 173.230.130.111:6880
type: 3.141.159.213:6880
type: 3.12.65.135:6880
type: 148.153.170.2:6880
type: 154.202.133.222:6880
type: 54.85.131.184:6880
type: 178.162.174.178:28003
type: 178.162.173.105:28003
type: 178.162.173.147:28003
type: 130.239.18.158:8539
type: 185.107.71.105:27633
type: 178.162.173.163:28006
type: 51.159.104.76:7186
type: 178.162.174.226:28005
type: 178.162.173.91:28005
type: 178.162.173.107:28005
type: 178.162.174.228:28007
type: 178.162.173.89:28007
type: 45.87.251.11:28096
type: 172.111.38.128:26091
type: 178.162.173.194:28016
type: 24.166.98.240:6889
type: 142.202.48.88:10099
type: 193.32.16.134:50171
type: 45.152.210.124:50171
type: 114.230.238.17:6884
type: 89.22.226.106:6884
type: 46.232.211.179:16809
type: 178.162.174.84:28010
type: 51.15.4.62:55042
type: 162.251.63.120:10019
type: 199.59.117.39:9010
type: 5.39.81.144:56611
type: 45.87.251.132:28183
type: 46.232.210.80:13259
type: 34.207.160.46:20872
type: 85.108.86.26:28677
type: 185.149.91.77:51006
type: 216.39.248.237:33424
type: 195.201.179.130:16489
type: 195.154.171.138:30519
type: 212.7.200.93:23999
type: 46.159.130.196:6882
type: 74.84.15.97:6882
type: 188.165.201.194:6882
type: 88.86.219.143:49001
type: 185.128.201.38:49001
type: 212.15.61.56:49001
type: 208.96.194.235:49001
type: 32.218.7.190:49001
type: 197.88.247.3:49001
type: 86.181.37.193:42959
type: 95.211.127.53:28008
type: 178.162.174.177:28008
type: 61.75.208.88:41135
type: 50.70.197.75:45840
type: 126.121.214.223:15590
type: 150.31.57.182:19679
type: 61.73.97.101:33083
type: 220.126.70.211:8033
type: 101.128.200.36:26099
type: 212.32.225.108:52694
type: 45.87.251.11:28075
type: 58.140.17.58:40919
type: 24.78.132.48:35293
type: 72.21.17.102:63192
type: 82.29.94.243:27252
type: 66.109.158.243:52527
type: 99.77.75.110:64460
type: 103.252.201.101:20520
type: 81.9.211.185:42238
type: 88.151.187.133:24659
type: 212.140.200.89:13433
type: 210.117.21.139:32950
type: 109.60.28.251:38488
type: 210.217.70.173:63625
type: 1.34.236.127:25675
type: 208.110.103.44:58572
type: 188.129.3.16:55555
type: 92.100.31.4:56400
type: 91.199.227.106:11300
type: 51.195.220.36:8643
type: 119.194.133.75:59271
type: 176.40.242.247:48349
type: 23.95.11.50:65524
type: 54.39.52.64:39450
type: 152.53.52.107:10240
type: 199.247.13.122:33572
type: 68.180.16.39:49426
type: 164.132.162.3:59363
type: 102.32.90.153:38244
type: 106.217.102.190:64337
type: 116.87.84.40:53018
type: 158.69.224.81:36034
type: 208.87.240.21:11162
type: 93.177.75.202:50050
type: 178.162.173.20:28000
type: 103.140.3.20:17466
type: 45.83.64.1:800
type: 77.101.241.194:50321
type: 189.138.32.83:57572
type: 45.131.79.82:64047
type: 119.229.78.160:15716
type: 195.154.172.179:25154
type: 46.232.210.61:64045
type: 83.149.84.32:28045
type: 138.97.217.26:5949
type: 45.87.251.174:43849
type: 45.91.208.120:10929
type: 79.142.76.251:39332
type: 69.160.114.39:37978
type: 54.39.52.64:32205
type: 119.194.47.161:41000
type: 187.243.42.7:7830
type: 93.46.81.94:20224
type: 197.146.126.78:63681
type: 77.239.254.98:1337
type: 93.177.75.130:52412
type: 5.149.72.80:51318
type: 121.178.64.64:7789
type: 189.128.112.196:28047
type: 176.159.242.0:22379
type: 185.203.56.20:62461
type: 45.87.251.144:29353
type: 51.159.17.26:51315
type: 5.79.77.50:54573
type: 90.52.236.100:11175
type: 221.162.140.34:33146

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/647f84df-7e9d-4d67-8780-6d5c9b1372f9

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/6cdf4e9d-c1f2-40e4-90dc-e4e84fdb8cf4

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54/

Threat name:

Linux.Trojan.SAgnt

Status:

Malicious

First seen:

2025-06-30 16:36:13 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7umaefvwuqknfj44qw36gozaxbsr7s3efvexgsqe7wwvju3axnka._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250630-t4ampatky3/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads MAC address of network interface

Reads hardware information

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/89bd141d-8ed2-4883-931d-7f6033e3f93e

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf fd180216b6a414d2a79c85b7e33b20b8651fcb642d49734a04fdad54d360bb54

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3558169/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample