MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb
SHA3-384 hash: 293ed760a2f4d88aa83a3777fb6ea91c978de242e5178bcd260276231564dfdcb103aa73e2b88e8a956d9c8198fcb25a
SHA1 hash: ab8c4fa3ec4d403b97183be623494f640601ce14
MD5 hash: e1620ce267814985eb0c49b5b4ea168e
humanhash: crazy-illinois-delaware-paris
File name:kpsmoused0
Download: download sample
File size:2'114'388 bytes
First seen:2026-02-18 18:59:34 UTC
Last seen:2026-02-19 18:31:50 UTC
File type: elf
MIME type:application/x-executable
ssdeep 49152:J8obHinm8ZSCxQ2HEgJ73U7MpGM6ApXtFau:JnTim8Znxl5J732M6ApXtFb
TLSH T165A53371FD589D97CE1E5F0A81B7090507498D61A7BD1BC206EC4CE319BBBC224EE6CA
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
3
# of downloads :
98
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/69960c7597feb4afd64ac38a/reports/e955ebd1-d68a-410a-abb3-426b9bceaac9/overview
Verdict:
Clean
File Type:
elf.64.be
Link:
https://opentip.kaspersky.com/70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/83dd58d4-c53f-4123-b272-0703f4429752
Behavior Graph:
Download SVG
%3 guuid=0e7b6d57-1900-0000-ba89-e64bcd070000 pid=1997 /usr/bin/sudo guuid=17775759-1900-0000-ba89-e64bd1070000 pid=2001 /tmp/sample.bin guuid=0e7b6d57-1900-0000-ba89-e64bcd070000 pid=1997->guuid=17775759-1900-0000-ba89-e64bd1070000 pid=2001 execve guuid=8d13665a-1900-0000-ba89-e64bd4070000 pid=2004 /usr/bin/dash guuid=17775759-1900-0000-ba89-e64bd1070000 pid=2001->guuid=8d13665a-1900-0000-ba89-e64bd4070000 pid=2004 clone guuid=aad1705a-1900-0000-ba89-e64bd5070000 pid=2005 /usr/bin/dash guuid=17775759-1900-0000-ba89-e64bd1070000 pid=2001->guuid=aad1705a-1900-0000-ba89-e64bd5070000 pid=2005 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/49c3a9ee-b0b0-4390-8c00-c431bafc0fa1
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1871437
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-18 19:13:32 UTC
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=odwacvmr46brbkm67zanmknbwuolzajl7bpu3uk6o7sovrdb4xfq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260218-xn4glsfs7e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3780661/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3780667/

Comments