MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0
SHA3-384 hash: 81d7a9d5fcb1c307ae07b13e237e56b88a8e864e5a5ed1c979c7bc17cf3109d20204c330c1f434745a1a4edec7ececb6
SHA1 hash: 1f1564322b5a9cccd49a23cb3824d7e7db64c0f1
MD5 hash: e05cace7fcd23c9944f16e5aede09bde
humanhash: iowa-wyoming-yankee-fix
File name:aVAmFddR
Download: download sample
File size:8'616'960 bytes
First seen:2026-03-17 01:16:39 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 196608:1htRZcuAPF/h4PMJLjiB/jKTjSJkHYKq0lcYJgdIs:1Dfc39/iPqXPHCkHFDlcugms
TLSH T13E963396F607DEF4C2D5E0F41DE0DAA113A1A12EC11289B23B45E38BDEB63D41FD6981
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter Skynet11
Tags:elf UPX

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
AU AU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d250d0ab-c965-41af-9eae-85f8c20f8db7/
Detection(s):
Unix.Trojan.Generic-9910178-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed packed upx
Link:
https://www.filescan.io/uploads/69b8ab9c493cb7d62d01099c/reports/43f0e726-7e48-4127-a02f-685f9951258f/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Unknown
File Type:
elf.64.le
Link:
https://opentip.kaspersky.com/3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c890544f-195b-48db-b564-5b021c15cddc
Behavior Graph:
Download SVG
%3 guuid=0c9ce2f3-1a00-0000-a9ab-fab1250a0000 pid=2597 /usr/bin/sudo guuid=e7fb1bf6-1a00-0000-a9ab-fab12d0a0000 pid=2605 /tmp/sample.bin guuid=0c9ce2f3-1a00-0000-a9ab-fab1250a0000 pid=2597->guuid=e7fb1bf6-1a00-0000-a9ab-fab12d0a0000 pid=2605 execve
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3eb8256f-adcf-4104-a43c-1f3318b8ea14
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-17 01:17:24 UTC
File Type:
ELF64 Little (Exe)
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwi4l6tvildaip2inxh5qsv5aarf5iwmvxl2imcfehv2tmyfncya._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260317-bng3qaay6q/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3d91c5fa7542c6043f486dcfd84abd00225ea2ccadd7a4304521eba9b30568b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments