MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d77820072bda4a45876ca676ebeea0f831fce252edc418065f6aed2c467dae4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash: 0d77820072bda4a45876ca676ebeea0f831fce252edc418065f6aed2c467dae4
SHA3-384 hash: 6c469d3e3bab6bfb915007e9fd87499b0f400d7bb8120efc06cb56aacd1f8f13b583f03043c8c745a68780e513814c6a
SHA1 hash: dbe9a48078508f5dd8d9d822c50bb8513537f2fc
MD5 hash: 1f0d3202866eb07bd9a4051dbadeb740
humanhash: earth-queen-fillet-king
File name:nknrjhk.x86_64
Download: download sample
File size:1'245'020 bytes
First seen:2026-05-23 00:44:05 UTC
Last seen:2026-05-23 03:31:41 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 24576:b20o/+j7dt622HYSPaBw4jH5lDCubrBfdryY1WyBO8:bJDjPLWSBw4ltrBfdryYhBO8
TLSH T18545F117FA7108A8DDAACC75825EB133D6297889C312B1273FD55F012B2AB24EF1DB51
telfhash t11061b4010fd56d1ef6e6c8e292f3006329360a2ecb6e17a05386feba3d99cc08455296
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence


File Origin
# of uploads :
2
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
expand lolbin rust
Status:
terminated
Behavior Graph:
%3 guuid=979c8d4e-2000-0000-a0b6-1211830d0000 pid=3459 /usr/bin/sudo guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463 memfd: delete-file write-file guuid=979c8d4e-2000-0000-a0b6-1211830d0000 pid=3459->guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463 execve guuid=82d1cd59-2000-0000-a0b6-1211900d0000 pid=3472 memfd: guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463->guuid=82d1cd59-2000-0000-a0b6-1211900d0000 pid=3472 clone guuid=53846c5b-2000-0000-a0b6-1211970d0000 pid=3479 memfd: guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463->guuid=53846c5b-2000-0000-a0b6-1211970d0000 pid=3479 clone guuid=1ab1855b-2000-0000-a0b6-1211990d0000 pid=3481 memfd: guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463->guuid=1ab1855b-2000-0000-a0b6-1211990d0000 pid=3481 clone guuid=4104bc5b-2000-0000-a0b6-12119a0d0000 pid=3482 memfd: zombie guuid=08cba150-2000-0000-a0b6-1211870d0000 pid=3463->guuid=4104bc5b-2000-0000-a0b6-12119a0d0000 pid=3482 clone guuid=cc84c45b-2000-0000-a0b6-12119c0d0000 pid=3484 memfd: guuid=4104bc5b-2000-0000-a0b6-12119a0d0000 pid=3482->guuid=cc84c45b-2000-0000-a0b6-12119c0d0000 pid=3484 clone guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485 memfd: dns net send-data write-file guuid=cc84c45b-2000-0000-a0b6-12119c0d0000 pid=3484->guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485 clone 80639f7d-8d8e-5d60-8819-65337bb0e774 criminalcloudflare.online:1337 guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->80639f7d-8d8e-5d60-8819-65337bb0e774 send: 256B a0528efd-1018-56b4-b518-221acb0fa7ca 9.9.9.9:53 guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->a0528efd-1018-56b4-b518-221acb0fa7ca send: 43B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 43B guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3486 memfd: guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3486 clone guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3487 memfd: guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3487 clone guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3495 memfd: guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3485->guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3495 clone guuid=3c4c2558-2700-0000-a0b6-12116d150000 pid=5485 memfd: guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3486->guuid=3c4c2558-2700-0000-a0b6-12116d150000 pid=5485 clone guuid=80207154-2e00-0000-a0b6-121178150000 pid=5496 memfd: guuid=741ace5b-2000-0000-a0b6-12119d0d0000 pid=3486->guuid=80207154-2e00-0000-a0b6-121178150000 pid=5496 clone
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
0 / 100
Behaviour
Behavior Graph:
n/a
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:ProgramLanguage_Rust
Author:albertzsigovits
Description:Application written in Rust programming language

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 0d77820072bda4a45876ca676ebeea0f831fce252edc418065f6aed2c467dae4

(this sample)

  
Delivery method
Distributed via web download

Comments