MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8
SHA3-384 hash:	22ae731a0836690f774c601649496df8029817ea38d4037c64911f8d50ee6ec06c9f3c04ea83416c05692381355b27b6
SHA1 hash:	c117e8bcb4219dd3fbc0e0069a708b33447cb279
MD5 hash:	02f0fe630bbfbf0a6fc47eafd1b8f8cf
humanhash:	ohio-green-island-pizza
File name:	linux.arm7
Download:	download sample
File size:	1'326'208 bytes
First seen:	2025-12-28 16:09:06 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	24576:LGv1P1yg1APOKhKwYiR3zl9NFz8H64tf5NO4QHFdYNpoSRM0eewGD:Lg3yg1C/swYO3zl3Fz66hZiNW8ZD
TLSH	T1B055335872D068F19872984BC322C4EF4D7E6437852BDB25081B5B4ECA867F7F06A256
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	1'326'208 bytes
File size (de-compressed) :	2'731'074 bytes
Format:	linux/arm
Unpacked file:	5ec65f18218c54d4a9fbd5fce15e2f632181055465319981646083f751bb68f3

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/50c478ac-ab09-46f1-bebe-76b01446b51b/

Verdict:

Unknown

File Type:

elf.32.le

First seen:

2025-12-28T13:17:00Z UTC

Last seen:

2025-12-28T13:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ea94b7b0-a848-43a6-aa43-0fff7b04c2c4

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4e1f39fc-9a15-48a1-bef0-00ba9b9346ad

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

22 / 100

Link:

https://www.joesandbox.com/analysis/1840834

Signature

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=esishdetvyeyytxq3t2e6fcqzmw2zcxojhvmr2meyd6jvtsewcua._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/251228-tlv6nsgq9w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5d7ade5a-cb07-4fa5-824b-935148239e6f

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2491238c93ae098c4ef0dcf44f1450cb2dac8aee49eac8e984c0fc9ace44b0a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research