30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213

Classification: Malicious

30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213 is a trojan (Linux ELF executable, 5.7 MB). Detected by 61 antivirus engines.

Detection summary

  • 61 antivirus detections
  • 0 IDS alerts
  • 5 processes observed
  • 0 contacted hosts
  • 3 DNS requests

MITRE ATT&CK associations

Malware families: GOMIR (S1198)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Gomir Triage 2026-07-06 12:42:09 2026-07-06 12:42:09 malicious-activity S1198 Gomir
Generic Malware Hybrid-Analysis 2024-02-08 01:45:03 2024-05-17 15:15:13

Tags

evasive backdoor gomir apt43 kimsuky apt discovery linux

Sample information

Filenames
.incoming_30584f13c0a9d0c8, 30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213
File type
ELF 32-bit LSB executable, Intel 80386, version 1 ...
Size
5947392 bytes
MD5
e562cf30d17d47347c7e6ffd249fc190
SHA-1
93edc15a20aac8b5193e5b22e35dbb09848e2ca0
SHA-256
30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213
First indexed
2024-02-08 01:31:59
Last updated
2026-10-12 02:30:47

Antivirus detections

EngineDetection
GoogleDetected
IkarusTrojan.Linux.DDoS
ALYacBackdoor.Linux.Gomir
AVGELF:Agent-CTF [Trj]
AhnLab-V3Trojan/Linux.Agent.5947392
Antiy-AVLTrojan/Linux.Agent.zv
ArcabitTrojan.Generic.D2194040
AvastELF:Agent-CTF [Trj]
AviraLINUX/AVF.Agent.tlpsh
BitDefenderTrojan.Generic.35209280
CAT-QuickHealElf.trojan.A12247344
CynetMalicious (score: 99)
DrWebLinux.BackDoor.Siggen.514
ESET-NOD32Linux/Agent.ZV
ElasticLinux.Trojan.Springtail
EmsisoftTrojan.Generic.35209280 (B)
F-SecureMalware.LINUX/AVF.Agent.tlpsh
FireEyeTrojan.Generic.35209280
FortinetLinux/Agent.ZV!tr
GDataTrojan.Generic.35209280
KasperskyHEUR:Backdoor.Linux.Gomir.gen
LionicTrojan.Linux.Gomir.m!c
MAXmalware (ai score=99)
McAfeeTrojan-FVAE!E562CF30D17D
MicroWorld-eScanTrojan.Generic.35209280
MicrosoftTrojan:Linux/Multiverze
RisingBackdoor.Gomir/Linux!8.1A3E2 (CLOUD)
SentinelOneStatic AI - Suspicious ELF
SkyhighArtemis!Trojan
SophosMal/Generic-S
SymantecLinux.Gomir
TencentLinux.Backdoor.Gomir.Ychl
TrendMicroBackdoor.Linux.GOMIR.THEBABD
TrendMicro-HouseCallBackdoor.Linux.GOMIR.THEBABD
VIPRETrojan.Generic.35209280
VaristE32/ABRisk.ABAO-71
ViRobotLinux.S.Agent.5947392
ZoneAlarmHEUR:Backdoor.Linux.Gomir.gen
alibabacloudBackdoor:Linux/Gomir.gyf
ArcabitTrojan.Kimsuky.175
BitDefenderTrojan.Kimsuky.175
CTXelf.trojan.gomir
ESET-NOD32Linux/Agent.ZV trojan
EmsisoftTrojan.Kimsuky.175 (B)
GDataTrojan.Kimsuky.175
IkarusTrojan.Linux.Agent
KingsoftLinux.Backdoor.elf.2023609
LionicTrojan.Linux.Gomir.4!c
McAfeeDti!30584F13C0A9
MicroWorld-eScanTrojan.Kimsuky.175
MicrosoftTrojan:Linux/Multiverze!rfn
NANO-AntivirusTrojan.Elf32.AVF.kpfqdq
RisingBackdoor.Gomir/Linux!8.1A3E2 (KTSE)
SkyhighTrojan-FVAE!E562CF30D17D
TencentMalware.Linux.Generic.1c03db6f
TrellixENSTrojan-FVAE!E562CF30D17D
VBA32Backdoor.Linux.Gomir
VIPRETrojan.Kimsuky.175
VaristE32/ABTrojan.ABAO-
alibabacloudBackdoor:Linux/Multiverze.Gen
huorongTrojan/Generic!522A32799E76200D

DNS requests

a978.i6g1.akamai.net canonical-lgw01.cdn.snapcraftcontent.com ipv6.msftncsi.com.edgesuite.net

Process list

NameCommand line
30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213/home/ubuntu/30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213
30584f13c0a9elf
30584f13c0a9elf
30584f13c0a9elf
30584f13c0a9elf