MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DDoSAgent

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e
SHA3-384 hash:	a6c516c7ca2e1c725686d3f1776e3a56cd05bbe2aeb64eae6cd6f3608ee19a2db166e78c691ca51f279f55ce42fcda19
SHA1 hash:	08ac650e4582fc892390ea2e1772c79ca85c28e9
MD5 hash:	d7a957d9270270eec939af749b4aed78
humanhash:	violet-sad-neptune-neptune
File name:	ethd0
Download:	download sample
Signature	DDoSAgent Create hunting rule
File size:	2'408'124 bytes
First seen:	2026-02-07 10:54:39 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	49152:1zqCkzyT5C7pTKqcaALIPpXOkZQ6XCWNUrSveS2Yn+tyeCt0wJdubHkcQ9qe:LoUkpTlukPpXf1CdrSveunBzzWkIe
TLSH	T1BEB5335C60F274152CE93D6FFDD62D9D238344DA628B87DDC532D1739683B3A2B0906A
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	2'408'124 bytes
File size (de-compressed) :	8'208'676 bytes
Format:	linux/amd64
Unpacked file:	75fff99805e874d9620066a1779ca972a80cf1f1abd7b83d83427ae8522fdffc

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7fa293b7-ce26-4fc7-afcb-bdcccc832118/

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/c9dec3bd-5fab-4906-8569-706b4086056d

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b3576aef-bec0-4760-945e-8352ea653a3b

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

21 / 100

Link:

https://www.joesandbox.com/analysis/1865173

Signature

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pejknfw7jrohwocc4twyerkoirnhbf6pollw6igazgmiuso2r2pa._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery linux upx

Link:

https://tria.ge/reports/260207-m1bl9abx6f/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.