MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c
SHA3-384 hash:	4d597d1d495183fc2fdc36f58034e7c5f9bfe5b510484430522868ba915c85c73117ff870cc8a2b1211abefb59116ef3
SHA1 hash:	4251ce4a5f1bf85724c7339be9ead660f6e991df
MD5 hash:	b5e49374a1b36a0c4881be9b1262e5cd
humanhash:	football-beer-salami-harry
File name:	pi486
Download:	download sample
File size:	126'003 bytes
First seen:	2026-01-26 00:55:19 UTC
Last seen:	2026-01-26 02:18:32 UTC
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	3072:qa3z5a9yc6D/QgtBj1LBH3EKlkz+bH2aJv9ipOpCsf6iCZSC2l5k:qqm10/QgtBhtH5Sz+bH2aJv9ip+C4VC3
TLSH	T172C30185AFA098F2DA13853310DBA77A57349A768000C71FEB4D3F64ACB279E119F56C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

61

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

50

Number of processes launched:

9

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c

Behaviour

Process Renaming

Anti-Debugging

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest

Result

Gathering data

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/2fe2c55f-95e5-4ecd-9823-98af4379615e

Intezer Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/59a523fe-585d-442e-ad0f-563012f33bf8

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1857367

Signature

Deletes system log files

Manipulation of devices in /dev

Sample tries to kill a massive number of system processes

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-26 00:56:32 UTC

File Type:

ELF32 Little (SO)

AV detection:

2 of 36 (5.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pqikhnuccxoxry346vkkpwng6uix2tli3dtl654mcc6xg6boajoa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260126-a932msft4a/

Behaviour

Reads runtime system information

Changes its process name

Reads process memory

Enumerates running processes

Deletes Audit logs

Deletes journal logs

Deletes system logs

Traces itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/7c10a3b68215dd78e37cf554a7d9a6f5117d4d68d8e6bf778c10bd73782e025c