MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 22 File information Comments

SHA256 hash:	4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9
SHA3-384 hash:	d7d1318662df4de299b18e0f5a6e72f0b3257ec59368a4b322b3f107c63d1827938356343f388cd12614bdc555ea70a7
SHA1 hash:	33b709b6daec18600a749ddce8fd37c8e25d77ba
MD5 hash:	dee183100487f259a9784d1c3ccca7fb
humanhash:	tennis-alaska-juliet-whiskey
File name:	wsvc_linux_v2
Download:	download sample
File size:	1'814'680 bytes
First seen:	2026-10-18 06:28:28 UTC
Last seen:	2026-10-18 06:28:31 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	24576:Fz1wKmtpD2a2/OUmYP/PjXgZQzQV48X4OphK2CAKtY:FzmKmT2a2/OULP8QO1hiC
TLSH	T1FC854B07BCA549A9C0AEA63189629252BB71BC450F3123DB3F50B37C2F77BD06A79714
telfhash	t18a2238704abd34b4a6aad910b36375b4957719a562fc38b01123ed84ffc5f802ce6837
gimphash	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 b042b6540809f7d2c37615de2667a76e82fde897f43ef0b24782ce687124559e

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	771'816 bytes
File size (de-compressed) :	1'814'680 bytes
Format:	linux/amd64
Packed file:	b042b6540809f7d2c37615de2667a76e82fde897f43ef0b24782ce687124559e

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Collects information on the OS

Collects information on the CPU

Collects information on the RAM

Receives data from a server

Collects information on the network activity

Launching a process

Sends data to a server

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

golang reconnaissance

Link:

https://www.filescan.io/uploads/6ad4673b35f797b8516180d9/reports/dd619def-f316-4d20-b9fe-470876b86903/overview

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2026-10-18T05:00:00Z UTC

Last seen:

2026-10-20T00:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cae173a1-543c-4279-a78f-345e1b7764d8

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4a0f2db8-c2ef-4183-976f-7132adafbd18

Result

Threat name:

n/a

Detection:

suspicious

Classification:

spre

Score:

27 / 100

Link:

https://www.joesandbox.com/analysis/1988486

Signature

Opens /proc/net/* files useful for finding connected devices and routers

Behaviour

Behavior Graph:

Download SVG

Score:

61%

Verdict:

Susipicious

File Type:

ELF

Link:

https://malprob.io/report/4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jq5vc7a7tt67qozlxkhkl6qnovwu72kdzo7ufusajsbsryxz624q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/261018-g8nznahw6l/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Discovers running processes

Reads CPU attributes

Reads system network configuration

Virtualization/Sandbox Evasion: Time Based Evasion

Enumerates running processes

Security Software Discovery

OS Credential Dumping

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/4c3b517c1f9cfdf83b2bba8ea5fa0d756d4fe943cbbf42d2404c8328e2f9f6b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	F01_s1ckrule Create hunting rule
Author:	s1ckb017

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	LIN_Sample_Unique_4c099562 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (elf, etat binaire)

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/