MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da
SHA3-384 hash: c4862c6304092e00420bc85e02740eeb7284f3fcfebb7fc753d146da600eb7c7ecc3667461d512e3732021d8e8e69879
SHA1 hash: 0f9653a8dfe301c44db1b386d982fd82f45fcc31
MD5 hash: 92c181c581bfb971b79177ffabc1faa8
humanhash: five-white-magazine-tennessee
File name:20e0astr21
Download: download sample
File size:186'172 bytes
First seen:2026-02-22 16:14:04 UTC
Last seen:2026-02-22 17:54:06 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 3072:ozdurayQy5HEcMf3odZIDJE3aSpCGkXP/wxqBMUzfC/e7532ZklMTQzL290:ozdurafekcMwd6DJqHpCZjMEC/C5mZOZ
TLSH T1A404F151FF0D0463DA526FF56E7B0B62D72D4CB224ABD124240A7AA61BB377B82077C4
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
3
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/46339c2a-d02b-4c6d-aadf-1f67376cffb8
Behavior Graph:
Download SVG
%3 guuid=bb388a50-1a00-0000-5a88-20a2200c0000 pid=3104 /usr/bin/sudo guuid=3037c252-1a00-0000-5a88-20a2280c0000 pid=3112 /tmp/sample.bin guuid=bb388a50-1a00-0000-5a88-20a2200c0000 pid=3104->guuid=3037c252-1a00-0000-5a88-20a2280c0000 pid=3112 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bbb32914-2303-4d1d-af75-1e8da0cedd9c
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1873096
Signature
Multi AV Scanner detection for submitted file
Spawns processes using file descriptor names (likely to hide the executable path or fileless malware)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1873096 Sample: 20e0astr21.elf Startdate: 22/02/2026 Architecture: LINUX Score: 52 21 169.254.169.254, 80 USDOSUS Reserved 2->21 23 109.202.202.202, 80 INIT7CH Switzerland 2->23 25 3 other IPs or domains 2->25 27 Multi AV Scanner detection for submitted file 2->27 7 20e0astr21.elf 3 2->7         started        11 python3.8 dpkg 2->11         started        13 dash rm 2->13         started        15 dash rm 2->15         started        signatures3 process4 file5 19 /memfd:vc5y3shi (deleted), ELF 7->19 dropped 29 Spawns processes using file descriptor names (likely to hide the executable path or fileless malware) 7->29 17 3 7->17         started        signatures6 process7
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7mzo346ab7yruktshvho7pt6qxq62hsveumhb3il7a53sxrchna._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260222-tps6gsfz8b/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3783645/
  
Delivery method
Distributed via web download

Comments