MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dakkatoni

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments

SHA256 hash:	5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3
SHA3-384 hash:	579342ffba2375899f4738ab87587bf0ab186408f5354a2296081a0ad5f2a3d5de8102707a5278c76c9313baaa585049
SHA1 hash:	c00d65f445216bfc2cbe8b4b095b4e1150fb9773
MD5 hash:	9867f891f9fa34fd5e95ca246b8a7fbe
humanhash:	failed-zulu-massachusetts-hydrogen
File name:	5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3
Download:	download sample
Signature	Dakkatoni Create hunting rule
File size:	108'264 bytes
First seen:	2026-09-16 11:17:41 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuz:7O/QJHZweEL/NOjCHm7C
TLSH	T189B3025B9CBA8DCDFE2B0EF92A474E4B4DE9F1E9F5C1391C067B10C017B86899514B48
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	GAYINT_DOT_ORG
Tags:	cowrie elf honeypot mips

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aaa7af386747e54200530c4/reports/48a275d4-0fb4-423e-ac47-cba8901fce83/overview

Verdict:

Unknown

File Type:

elf.32.be

Link:

https://opentip.kaspersky.com/5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/aab541ac-60cb-42aa-be88-64c1f452de05

Behavior Graph:

Download SVG

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/430959a3-a091-4364-a3ce-39371f604302

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3/

Threat name:

Linux.Trojan.Dakkatoni

Status:

Malicious

First seen:

2020-10-03 22:01:40 UTC

File Type:

ELF32 Big (Exe)

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lgk5dzr4hohdhvej4tj4fb24rtd65dx2ppvnhgpbjrq3wmaytsrq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

upx

Link:

https://tria.ge/reports/260916-necsvsan8v/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5995d1e63c3b8e33d489e4d3c2875c8cc7ee8efa7bead399e14c61bb30189ca3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_DVR_Botnet_Hama_UPX Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects packed and unpacked ELF IoT/DVR botnet variants targeting UPX compression structures and uncompressed code

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Packer_Patched_UPX_62e11c64 Create hunting rule
Author:	Elastic Security
Reference:	https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/