MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f
SHA3-384 hash: e48f63e21648f197d2fc2223dd318f81aa3d7d2b860b5e649c0528e1ea2738069dc118a330a6a4b312d15bcfd2c4f415
SHA1 hash: 79a4bb674832b7406de43c0927db9b88fda2f6c1
MD5 hash: c14baf41b726e2b76da077425830a8bd
humanhash: india-happy-white-victor
File name:arm7
Download: download sample
File size:327'420 bytes
First seen:2025-12-25 07:22:16 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:v7lQRaj30gcNbrlFZxd/YVvFJAc9Yq+UzCUSTqaNf3eFeyhx:j+ajEJnjwVvPZ9YqLbWq625x
TLSH T1216423D6269169F447A9F48B5798AD0416ECE130CF376D88CEC108CE7523E2BC58D6FA
Magika unknown
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/694ce6623f8fdbf8e951b61c/reports/cd8013f2-3d4d-4878-b921-7c80f1327106/overview
Verdict:
Unknown
File Type:
elf.32.le
Link:
https://opentip.kaspersky.com/2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/207a97e7-18d6-4fc8-8473-97b4f5703aba
Behavior Graph:
Download SVG
%3 guuid=c214c9ab-1700-0000-12a7-79ac780c0000 pid=3192 /usr/bin/sudo guuid=1b25cdae-1700-0000-12a7-79ac7f0c0000 pid=3199 /tmp/sample.bin guuid=c214c9ab-1700-0000-12a7-79ac780c0000 pid=3192->guuid=1b25cdae-1700-0000-12a7-79ac7f0c0000 pid=3199 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/110e4aa5-efde-4da7-afe2-20ef5b37c3e7
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1839237
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f664vfwizxwejyj3lpvfn6yrr2opnovxrmcgm6r25sdn3p3nru7q._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
upx
Link:
https://tria.ge/reports/251225-h7ev2agk3y/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/56f4db61-accd-4368-828b-81fbb06a238d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 2fbdca96c8cdec44e13b5bea56fb118e9cf6bab78b04667a3aec86ddbf6d8d3f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3733107/
  
Delivery method
Distributed via web download

Comments