MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44
SHA3-384 hash: 2ea63ea0f3b8cf1eac4bfd070f7de1c0492f613de3111b8da68d807b3c2e9549b0689c90b0d8c8dd6f265a5eab8ca015
SHA1 hash: d209ae7755e841f42bc35d603abdc778484acb96
MD5 hash: f0ea2eba9028ac1224a7ddb6269595c9
humanhash: hamper-saturn-saturn-oxygen
File name:x86
Download: download sample
File size:120'836 bytes
First seen:2026-08-09 14:45:21 UTC
Last seen:2026-08-11 16:14:27 UTC
File type: elf
MIME type:application/x-executable
ssdeep 3072:zJhC6ZDR8jRZQy1icC5aI4WDefgwC53pd10gFdAnoutz:NxZyRZQwicAaI4WvwCVL2g7SoSz
TLSH T10EC312BFDBA92905C31D427D860DF287BCA2AED9A03024DD46F474D95D8E34472B97C8
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
3
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/caf2c389-08a9-4b2e-b948-b522e089aa0f/
Detection(s):
Unix.Trojan.Mirai-10028259-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Kills processes
Opens a port
Sends data to a server
Connection attempt
DNS request
Substitutes an application name
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai packed upx
Link:
https://www.filescan.io/uploads/6a78928e6226b5674cb45de0/reports/ef26f48f-2e7e-47aa-8f0f-002be28e1c93/overview
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-08-10T20:56:00Z UTC
Last seen:
2026-08-10T21:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b9a5636e-04ed-43b2-b6a3-6efda07ff35e
Behavior Graph:
Download SVG
%3 guuid=26ffa854-1900-0000-bba2-f6ae80090000 pid=2432 /usr/bin/sudo guuid=80214857-1900-0000-bba2-f6ae83090000 pid=2435 /tmp/sample.bin net guuid=26ffa854-1900-0000-bba2-f6ae80090000 pid=2432->guuid=80214857-1900-0000-bba2-f6ae83090000 pid=2435 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=80214857-1900-0000-bba2-f6ae83090000 pid=2435->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441 /tmp/sample.bin dns net send-data zombie guuid=80214857-1900-0000-bba2-f6ae83090000 pid=2435->guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441 clone guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 54d92a3b-1447-55af-b534-047898c60c8d 1.1.1.1:53 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->54d92a3b-1447-55af-b534-047898c60c8d send: 220B 09238610-e25b-5147-b0fe-ec09587d62b6 45.123.191.90:23 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->09238610-e25b-5147-b0fe-ec09587d62b6 send: 133B 1a45583f-cd73-59b6-b658-0274a8493901 45.123.191.90:25565 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->1a45583f-cd73-59b6-b658-0274a8493901 send: 129B 3085e686-8860-502a-a1b8-0e897bd4de2b 45.123.191.90:80 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->3085e686-8860-502a-a1b8-0e897bd4de2b send: 86B 41572e8e-6fd5-57a0-87ce-df0a1cbc62a4 156.246.90.214:25565 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->41572e8e-6fd5-57a0-87ce-df0a1cbc62a4 send: 43B 69628ee0-85fe-5709-85e9-4a3c781eb528 156.246.90.214:8080 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->69628ee0-85fe-5709-85e9-4a3c781eb528 send: 129B da254141-0653-5026-b4f4-5977edbad4e1 156.246.90.214:123 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->da254141-0653-5026-b4f4-5977edbad4e1 send: 43B 614e67fa-bb5c-5ca8-917d-273ba3ee6504 156.246.90.214:80 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->614e67fa-bb5c-5ca8-917d-273ba3ee6504 send: 43B cab72fba-3368-5398-9a7d-fae74533a953 45.123.191.90:8080 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->cab72fba-3368-5398-9a7d-fae74533a953 send: 86B e803b49c-13e5-5b4d-ba5d-acac055a5f6d 45.123.191.90:123 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->e803b49c-13e5-5b4d-ba5d-acac055a5f6d send: 43B e86793fc-807f-514d-8f63-ba72ba2f9200 178.83.206.213:8080 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->e86793fc-807f-514d-8f63-ba72ba2f9200 send: 43B 1782b6d7-08f7-5271-9967-97d005bdc197 178.83.206.213:123 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->1782b6d7-08f7-5271-9967-97d005bdc197 send: 86B d1cc8f97-23c8-5486-9aa2-6be53a765677 178.83.206.213:23 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->d1cc8f97-23c8-5486-9aa2-6be53a765677 send: 43B f70743b6-cf93-5786-b272-04aa08f77233 178.83.206.213:80 guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->f70743b6-cf93-5786-b272-04aa08f77233 send: 4B guuid=cb25bc59-1900-0000-bba2-f6ae8b090000 pid=2443 /tmp/sample.bin guuid=d2e8aa59-1900-0000-bba2-f6ae89090000 pid=2441->guuid=cb25bc59-1900-0000-bba2-f6ae8b090000 pid=2443 clone guuid=68abcb59-1900-0000-bba2-f6ae8c090000 pid=2444 /tmp/sample.bin guuid=cb25bc59-1900-0000-bba2-f6ae8b090000 pid=2443->guuid=68abcb59-1900-0000-bba2-f6ae8c090000 pid=2444 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a8407265-edb7-4171-a533-2ed6c3f5ad67
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1954673
Signature
Connects to many IPs within the same subnet mask (likely port scanning)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample scans a subnet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1954673 Sample: x86.elf Startdate: 09/08/2026 Architecture: LINUX Score: 68 29 156.234.168.173, 1280 YANCYLIMITED-AS-HKYancyLimitedHK Hong Kong SAR China 2->29 31 156.234.168.174, 1280 YANCYLIMITED-AS-HKYancyLimitedHK Hong Kong SAR China 2->31 33 98 other IPs or domains 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Connects to many IPs within the same subnet mask (likely port scanning) 2->39 41 2 other signatures 2->41 9 x86.elf 2->9         started        signatures3 process4 process5 11 x86.elf 9->11         started        process6 13 x86.elf 11->13         started        15 x86.elf 11->15         started        17 x86.elf 11->17         started        process7 19 x86.elf 13->19         started        21 x86.elf 13->21         started        23 x86.elf 15->23         started        25 x86.elf 15->25         started        27 x86.elf 17->27         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mg4qhorpcdd4dfus5bquqr2eaygsmd3f3gxoyguyfxaz2tscbnca._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260809-r41srsszfx/
Behaviour
Reads runtime system information
Changes its process name
Modifies Watchdog functionality
Creates a large amount of network flows
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 61b903ba2f10c7c19692e861484744060d260f65d9aeec1a982dc19d4e420b44

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897954/
  
Delivery method
Distributed via web download

Comments