🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f
SHA3-384 hash: 6a709682fe5e0dd5044ed22ed0938cbed8b2eb00b8c5fa42ae0296e7632f5a5b68c5fbae4d4f37b47e9668d7c1ba3e4d
SHA1 hash: 99d254c70dbb1aa9a975d8145c725ca43436da51
MD5 hash: 20fdbd9bf02ad6ae4862a6ea5f1f0997
humanhash: shade-uncle-three-paris
File name:54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f
Download: download sample
File size:36'044'800 bytes
First seen:2026-11-12 14:00:15 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 786432:0HpVq/0V7kuE3VH15rngyckjhT1g+6IR5H8F:0HK/0V7OVVlRT1g+64V8
TLSH T14C873313F38771BDD1FAC2B14A4B913633B570969B2133374AD6D2762CB6A448F52EA0
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter beserko
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a5f7d282-134c-4b04-8f9b-a8f90ca18076/
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
bash lolbin packed upx
Link:
https://www.filescan.io/uploads/6af5c6843ad5a880731d38d2/reports/c4d9378e-6239-4588-a4c8-272934b720ce/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/62f25709-693c-44f5-9071-d7202751d52e
Behavior Graph:
Download SVG
%3 guuid=50916f90-1b00-0000-0559-cd4eb90a0000 pid=2745 /usr/bin/sudo guuid=3a5b3f92-1b00-0000-0559-cd4ebf0a0000 pid=2751 /tmp/sample.bin guuid=50916f90-1b00-0000-0559-cd4eb90a0000 pid=2745->guuid=3a5b3f92-1b00-0000-0559-cd4ebf0a0000 pid=2751 execve
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/2004739
Signature
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktovtloeux5ce4nqzozxf646jnm3k2pbhnwlkwo3m56u6c4yh2hq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/261112-rbnbzagt7q/
Malware Family:
malpack
Create hunting rule
Malicious:
True
Tags:
64bit upx elf
Link:
https://intel.virussign.com/intelligence/file/54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/54dd59adc4a5fa2271b0cbb372fb9e4b59b569e13b6cb559db677d4f0b983e8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:GoBinTest
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:LIN_Sample_Unique_2bcc91fd
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:2bcc91fdedb8c583a9fe883be9ad453333a1bba0fdf655474982db3cbb8e7a74.sh
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments