MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Prometei


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac
SHA3-384 hash: cc4057819c060bbf44c9d4201a15c273a3ccdbe341f4e2afc5e56708682bb2f91e96d1fddd4abd0c56a750a26ecabc46
SHA1 hash: bfb86aa532d31cbf9abb62d226c0b861a0aec494
MD5 hash: 23d5b24923ab86b2164082ec504b1d42
humanhash: pasta-pizza-ohio-robin
File name:23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac
Download: download sample
Signature Prometei
Create hunting rule
File size:1'741'760 bytes
First seen:2026-07-16 05:13:43 UTC
Last seen:2026-07-16 14:26:45 UTC
File type: elf
MIME type:application/x-executable
ssdeep 49152:0zKgCn/ayxJjG0Tpm2Gl3m2inAlWSzisMcR9pS:CVCyybrcHW2in8WSD5R9pS
TLSH T19E85331639D6CA1CB595582DDD4B182EAD26755BDF2FCC1E009C0E2B49E32A270D3F2D
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter c2hunter
Tags:elf Prometei wraith

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0237e721-3f80-4c2e-ba1d-72850f27b7df/
Detection(s):
SecuriteInfo.com.Other.Malware-gen.13339213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
hacktool packed upx
Link:
https://www.filescan.io/uploads/6a5868bd056aea870381d000/reports/36e08b1c-b0c4-40fc-86e9-5a458ccf156b/overview
Verdict:
Unknown
File Type:
elf.64.le
Link:
https://opentip.kaspersky.com/23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8fefb7fe-a536-44a6-a57f-b31560184aea
Behavior Graph:
Download SVG
%3 guuid=c7a34bcc-1a00-0000-00bd-d40f420d0000 pid=3394 /usr/bin/sudo guuid=166a3cce-1a00-0000-00bd-d40f4a0d0000 pid=3402 /tmp/sample.bin guuid=c7a34bcc-1a00-0000-00bd-d40f420d0000 pid=3394->guuid=166a3cce-1a00-0000-00bd-d40f4a0d0000 pid=3402 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6fb042ef-1c79-4b62-a476-c80947d1dc41
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-16 05:14:45 UTC
File Type:
ELF64 Little (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=epgdlwfcxyj2agrx4ziy7ygcq7aisxdgqvxfqyscdlitjw2zfcwa._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260716-fxcltagz8x/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments