MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 15 File information Comments

SHA256 hash:	134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1
SHA3-384 hash:	31c5933357da075009e6ed770e3eced2889e9586927359e5ecfca03c999d444f7f21e26682a557662f5bf54633daa196
SHA1 hash:	8cd1bed4c26ba3cd15e657b92ca5253628b5f751
MD5 hash:	b71a2f0836d76d308d718ebfc6cf00fd
humanhash:	maryland-lake-louisiana-gee
File name:	0980b29bdac6b74fb3a4875a3215373c4ea392bc4a60a7bf931ad888ba063741
Download:	download sample
File size:	2'875'527 bytes
First seen:	2026-10-14 11:22:30 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	24576:3Usgoew42CTybTvMQJiyucP6B+hM4ztt+C3UMMrTGuZN2IH6pRfFsczql7:33goev2xvMdfet+4RuueczqF
TLSH	T176D54B13BCE50895C4FEA271952A8222FA747C480B3523DF6B90B7781F337E19976B91
telfhash	t16b72ba75497c74b1b2aad961f3b3b574e53319b177f838b00022a992efd0e451caa827
gimphash	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 0980b29bdac6b74fb3a4875a3215373c4ea392bc4a60a7bf931ad888ba063741

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	1'008'928 bytes
File size (de-compressed) :	2'875'527 bytes
Format:	linux/amd64
Packed file:	0980b29bdac6b74fb3a4875a3215373c4ea392bc4a60a7bf931ad888ba063741

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Sends data to a server

Receives data from a server

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

golang obfuscated

Link:

https://www.filescan.io/uploads/6acf662499e466b8e3c5b2ea/reports/d093ccac-ce10-4172-980e-7c35c30bb712/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Unknown

File Type:

elf.64.le

First seen:

2026-10-14T09:51:00Z UTC

Last seen:

2026-10-14T10:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/a5f3e44c-bb58-41d3-93ca-2eaa53681df1

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/1c48380e-887f-4e61-8f81-bbfbd773345f

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

5 / 100

Link:

https://www.joesandbox.com/analysis/1986993

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cnechrz3rxnvohvcykehfexmr6s5qmfj7ennfkgdhlbmjtjxs3aq._file

Result

Malware family:

n/a

Score:

4/10

Tags:

discovery linux

Link:

https://tria.ge/reports/261014-nhagxafg92/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Reads CPU attributes

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.29

Link:

https://yomi.yoroi.company/submissions/134823c73b8ddb571ea2c2887292ec8fa5d830a9f91ad2a8c33ac2c4cd3796c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	DIICOT_2026_kit_garble Create hunting rule
Author:	eFeSpain
Description:	DIICOT/Mexals 2026 kit - garble package names shared by the bot and the loader
Reference:	https://blog.efespain.com/en/chapter-27/

Rule name:	F01_s1ckrule Create hunting rule
Author:	s1ckb017

Rule name:	GoBinTest Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	LIN_Sample_Unique_4c099562 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (elf, etat binaire)

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/