MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f
SHA3-384 hash:	7191819decd05d5bc214e166ef9aa4e35ccaa16d28ee087c5056336762760b910576dace1ae268eaa701a187970aa891
SHA1 hash:	5808d8d832a5e07599b556d23e36f63923fe3279
MD5 hash:	3f678081c88a1d7e57520875c1c9e12d
humanhash:	wisconsin-nevada-kansas-lactose
File name:	na
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	133'196 bytes
First seen:	2026-07-29 13:50:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:2O7qPuXXxzxeKk9Tkjzgi57KyKhFvhKkWaxhZ1J9M7khvW:2d2XXIdkdahFv7WaxhZ9M7khvW
TLSH	T1B7D312755D303620D8A47EB9BCB7A831DBEDE6503BFC213F218656F905938610E1D2B6
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

79

Origin country :

DE

Vendor Threat Intelligence

ACCE UPX_ELF_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/21cf0ac0-fd2d-47d6-9106-f1ecbdd225a6/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Collects information on the network activity

Opens a port

Locks files

Launching a process

Collects information on the RAM

Sets a written file as executable

Sends data to a server

Runs as daemon

Kills processes

Collects information on the CPU

Creates directories

Connection attempt

Changes access rights for a written file

Creating a file in the %temp% directory

Creating a process from a recently created file

Manages services

DNS request

Receives data from a server

Changes the time when the file was created, accessed, or modified

Creates or modifies files in /cron to set up autorun

Accesses SSH

Creates or modifies files in /init.d to set up autorun

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed upx

Link:

https://www.filescan.io/uploads/6a6a0578add34eca272cb632/reports/8f876aaa-beb2-4ff3-81f4-c3adb2fa9120/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2026-07-20T04:08:00Z UTC

Last seen:

2026-07-24T10:50:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a1e1436a-ab84-4c26-9470-e3735958afe8

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4510d877-36d6-4d4a-a53c-3b1019104020

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1949585

Signature

Connects to many IPs within the same subnet mask (likely port scanning)

Drops invisible ELF files

Opens /proc/net/* files useful for finding connected devices and routers

Performs DNS TXT record lookups

Sample is packed with UPX

Sample scans a subnet

Sample tries to persist itself using cron

Sample tries to persist itself using System V runlevels

Tries to read the AWS credentials file

Tries to read the SSH private key file

Writes identical ELF files to multiple locations

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lwaoc2y5finifl7ivoe4fuy36uonbfs7l7ogldfbkulhwtbqvy7q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

antivm discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/260729-q57f9svhmh/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Creates/modifies Cron job

Modifies rc script

Modifies systemd

Executes dropped EXE

Adds new SSH keys

Contacts a large (786) amount of remote hosts

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5d80e16b1d2a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.