DigitalSide Threat Intel

roze.i586

First submission 2024-10-13 20:56:02

File details

File type: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Mime type: application/x-executable
File size: 135.41 KB (138662 bytes)
MD5: f900122f36f2bbb254586ab4c87f489d
SHA1: 4c3de80731fc4a0cb3eea08ede3a2ee7848be857
SHA256: ebfac47f25da3fa455f3d85c45e4bd8c54f11c8b6bada2f21e5a55bef2de3519

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 44/77 VT report date: 2024-10-13 20:32:57
Malware Type 1 trojan
Threat Type 3 gafgyt mirai bashlite

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://93.123.85.167/roze.i586 VirusTotal Report 93.123.85.167 VirusTotal Report 2024-10-13 20:56:02

Strings analysis - Possible IPs found 11

1.9.2.8
3.0.4.2
8.8.8.8
93.123.85.167
1.9.2.6
1.9.2.4
1.8.1.11
1.9.0.8
1.9.0.6
1.9.1.1
1.9.1.3

Strings analysis - Possible URLs found 5

http://www.baidu.com/search/spider.html)
http://www.baidu.com/search/spider.htm)
http://fast.no/support/crawler.asp)
http://feedback.redkolibri.com/
http://www.billybobbot.com/crawler/)