🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2
SHA3-384 hash: 8c80f8e4dea7935841bef52695079d190828dade48304a30a7983c9804350990177f8a0c20ea39ef21e2f2b709523f11
SHA1 hash: 98e9e28b04cfb0dd4a5a6d4108a59d094428ca03
MD5 hash: e5e7f520ff9159c719a87922bbce0b80
humanhash: mike-zebra-oscar-lamp
File name:bot_mipsel
Download: download sample
File size:85'488 bytes
First seen:2026-05-16 16:21:42 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 1536:3N2GyVP3r62B13x7KvE6NQ4tJkUthqbB9+Ahx1bQ3OYavnUGAWGj:3NzyVP3r6ydxUaUthcBVpbQ3ODs8W
TLSH T1E38302607E61B60FCBF99E302842F51DF99F64C12BC74D987E0505B1A77A4DF8922A70
Magika elf
Reporter BlinkzSec

Intelligence

File Origin
# of uploads :
1
# of downloads :
18
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
custom
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Clean
File Type:
elf.32.le
First seen:
2026-05-16T13:52:00Z UTC
Last seen:
2026-05-17T14:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0ec8db6c-a9d6-4c6a-8f7f-5ed426112f21
Behavior Graph:
Download SVG
%3 guuid=b35fb3db-1a00-0000-4f6a-f4a7880a0000 pid=2696 /usr/bin/sudo guuid=b6c68cde-1a00-0000-4f6a-f4a78f0a0000 pid=2703 /tmp/sample.bin guuid=b35fb3db-1a00-0000-4f6a-f4a7880a0000 pid=2696->guuid=b6c68cde-1a00-0000-4f6a-f4a78f0a0000 pid=2703 execve
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4cfdbd63-8cd2-4e1a-bae8-cc72ccf44bd3
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-16 16:02:56 UTC
File Type:
ELF32 Little (SO)
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6z34rc3eozso3ygoq6um2dntukjhfk4iyubnhwoddu2nd42jcza._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260516-tvk23afx2x/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Changes its process name
Creates a large amount of network flows
Write file to user bin folder
Contacts a large (4727) amount of remote hosts
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:elf_arm_mips_ko_so
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3847852/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3847866/
  
URLhaus
https://urlhaus.abuse.ch/url/3848026/

Comments