MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76
SHA3-384 hash:	042a36217aaaac49282cd323c5447bb11a7048f27c69131a97f54fd1681a59f0ad3a672cfb012a73f651b6f3683af90d
SHA1 hash:	96360531195ede16ea35e3f9a3b958194530ac6f
MD5 hash:	2a057a71e555b788ecf1c939a8f7dc7d
humanhash:	mango-lion-alaska-missouri
File name:	ppc
Download:	download sample
File size:	24'016 bytes
First seen:	2026-09-15 16:04:25 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	384:rRT9osofADj7cIxakDJTDx/7NwgAVjTdAkA/bttVLV3OZ6:rbom7cIB1VzAZAp/5tr3F
TLSH	T137B2190677580E5BD1AFBAB03A3F1BD493EBFF9112A4D681160EA7CAC1B5E371141C89
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 1499d54227d99620aa425bb698df54d641b6e8c22afade69899475406f8dfae8

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	15'212 bytes
File size (de-compressed) :	24'016 bytes
Format:	linux/ppc32
Packed file:	1499d54227d99620aa425bb698df54d641b6e8c22afade69899475406f8dfae8

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa96cbb516dbee4ae2c927c/reports/7522b7e7-a9a5-4790-a388-3988ec27d041/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2026-09-16T20:43:00Z UTC

Last seen:

2026-09-17T06:19:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/94773422-d751-4487-931d-228e23d327c5

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1973302

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmgw3rrqen6vtuk2b2ppx7ocuun7pizbh4ehuih5mmmhsqwlrz3a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260915-tjmrhsxtgs/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/130d6dc630237d59d15a0e9efbfdc2a51bf7a3213f087a20fd63187942cb8e76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/