🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680
SHA3-384 hash: b4376260883db1ec171612005f13fc729059437d6cdb51daff32369f43e5a7cf24965932c2c0a08d514e838f1045fcd8
SHA1 hash: 4415b238cbc52da6c33e59337bce622a3dfe0cf4
MD5 hash: 7e9a108db3ed5a333977545dddbd4dff
humanhash: orange-virginia-texas-six
File name:r58m.bin
Download: download sample
File size:41'252'384 bytes
First seen:2026-11-05 16:05:07 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 786432:oycKB2sT36csNplIG6c9SOEvSUds3BJ8NsHXmz9UYdv4kAFoRGeRuSDhjWxDFLn:vflelv6rvSUiRqLfAFoRR6ZLn
TLSH T1429733A92076FF11C49D338D5B7B3DC87941C065AB8D79E1279F2F2126F29BA3B0A144
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6aeca942a976a7b84bb330eb/reports/f85d7ea4-5bd9-4efa-b91e-32ee22c4d8e8/overview
Verdict:
Unknown
File Type:
elf.64.le
First seen:
2026-10-23T22:58:00Z UTC
Last seen:
2026-10-23T23:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ada5c926-1f99-4701-ad0b-6e749bb03587
Behavior Graph:
Download SVG
%3 guuid=ba8b8f95-1b00-0000-33b6-836d920c0000 pid=3218 /usr/bin/sudo guuid=10014899-1b00-0000-33b6-836d9a0c0000 pid=3226 /tmp/sample.bin mprotect-exec guuid=ba8b8f95-1b00-0000-33b6-836d920c0000 pid=3218->guuid=10014899-1b00-0000-33b6-836d9a0c0000 pid=3226 execve guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200 /tmp/sample.bin guuid=10014899-1b00-0000-33b6-836d9a0c0000 pid=3226->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4201 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4201 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4202 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4202 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4207 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4207 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4208 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4208 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4209 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4209 clone guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4222 /tmp/sample.bin guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4200->guuid=c61c0e38-1d00-0000-33b6-836d68100000 pid=4222 clone
Result
Threat name:
n/a
Detection:
suspicious
Classification:
mine
Score:
21 / 100
Link:
https://www.joesandbox.com/analysis/1999161
Signature
Found strings related to Crypto-Mining
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 1999161 Sample: r58m.bin.elf Startdate: 05/11/2026 Architecture: LINUX Score: 21 5 r58m.bin.elf 2->5         started        signatures3 11 Found strings related to Crypto-Mining 5->11 8 r58m.bin.elf 5->8         started        process4 signatures5 13 Found strings related to Crypto-Mining 8->13
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atlk5qkwpv5ur3rdd7pwr7d6c4wlxagjhnxjbrvr5ggsym3u62aa._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery linux upx
Link:
https://tria.ge/reports/261105-tjpacabw61/
Behaviour
Reads runtime system information
Malware Family:
wacatac
Create hunting rule
Malicious:
True
Tags:
sets-process-name elf 64bits shared-lib
Link:
https://intel.virussign.com/intelligence/file/04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:upx_antiunpack_elf64
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:UPX Anti-Unpacking technique to magic renamed for ELF64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 04d6aec1567d7b48ee231fdf68fc7e172cbb80c93b6e90c6b1e98d2c3374f680

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4057659/

Comments