MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f
SHA3-384 hash:	6ad5633600766ce156f02e51d3189291bc38ff2ecb0919ae246817d2f755d68b01569313d806c1a6d3aa7fecaa55a311
SHA1 hash:	e33ca3445d398cc16624fda5a05ca14b77805132
MD5 hash:	34d3e3c4ba1858db062dfec32a0b6bd1
humanhash:	berlin-vegan-nuts-king
File name:	arm7
Download:	download sample
File size:	87'340 bytes
First seen:	2025-11-30 16:46:13 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:ounv4WTUXgMe6Tf9ImHXcVujIFaaK+B31AULXEpZalkI2iWoVqTfwYMu6PJ+x:+WTUXgD6Tf9IGXAujI4az31AU1+oVqTU
TLSH	T146830846B9819F02D5C621FAFB9F415933136FB8E3F97102DD20AF6023869DB0E76612
telfhash	t13401cb804a1451ec37e0930590fe777b9bbd71fc39802c06aa9e63998273ec9b10882d
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 4354f1fd226019e3009b68392c691f1b37793fb1be8d3b22b18ca62e01113f36

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	46'560 bytes
File size (de-compressed) :	87'340 bytes
Format:	linux/arm
Packed file:	4354f1fd226019e3009b68392c691f1b37793fb1be8d3b22b18ca62e01113f36

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Kills processes

Receives data from a server

Opens a port

Sends data to a server

Mounts file systems

Creating a file

Connection attempt

Substitutes an application name

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

expand gcc lolbin mirai rust

Link:

https://www.filescan.io/uploads/692c750ed0d5e7288b519b2c/reports/83f6f0fe-15f9-4577-96f4-264935e4608f/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f

Behaviour

Anti-VM

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/af1a45b3-a796-43c3-be88-a68d26f115d9

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a4a7533e-b9df-4b2e-a2dc-e2c42e20b2b3

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1823123

Signature

Antivirus / Scanner detection for submitted sample

Sample reads /proc/mounts (often used for finding a writable filesystem)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jwjctsgfjtawfxemvuhh2iur25tgceob3n232zankgaest2toshq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251130-valcrs1jdj/

Behaviour

Reads runtime system information

Changes its process name

Modifies Watchdog functionality

Renames itself

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1ec8c789-f4be-4b1c-9b15-a5c37a1fb585

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4d9229c8c54cc162dc8cad0e7d2291d7666111c1db75bd640d5180494f53748f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.