MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rekoobe


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3
SHA3-384 hash: f1eb945603a64752f359bc1bb969b525e78153aa31b91c0541fa6c53350a677fa25a1ac44d7b90243c1b3bcea8db2359
SHA1 hash: 62d72d0a735bc898dc8978c47a19fbc4fc9eb7f4
MD5 hash: e4cbd88781a5b2f898d83a543bc48ee2
humanhash: winner-blossom-kentucky-earth
File name:d
Download: download sample
Signature Rekoobe
Create hunting rule
File size:52'264 bytes
First seen:2026-06-22 15:52:58 UTC
Last seen:2026-06-22 21:44:51 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:HGiHNnsbnhhWNNuVVHrDqHekyN/1H5xuM8N:mysbnhhWuPHrDq+xN/1Zx2N
TLSH T1A0338E4365214EBFC88922314FAF67217997BC28EF4A332776849750602EB37BE60371
telfhash t196d02287cabeaa70abe33568ac39402e92035e16806227203f50c454d83b00880889ef
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter BlinkzSec
Tags:Rekoobe

Intelligence

File Origin
# of uploads :
3
# of downloads :
59
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Detection(s):
YARA.SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
DNS request
Connection attempt
Receives data from a server
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
gcc golang rekoobe
Link:
https://www.filescan.io/uploads/6a395b0190632a45f7335535/reports/fb768def-fc13-475e-8bb5-bc18750e7047/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2024-08-02T15:19:00Z UTC
Last seen:
2026-06-24T01:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f1122ac3-5af9-4368-8003-13b9805d2c8e
Behavior Graph:
Download SVG
%3 guuid=fd7329a9-1b00-0000-a2b5-618e350b0000 pid=2869 /usr/bin/sudo guuid=112381ac-1b00-0000-a2b5-618e370b0000 pid=2871 /tmp/sample.bin guuid=fd7329a9-1b00-0000-a2b5-618e350b0000 pid=2869->guuid=112381ac-1b00-0000-a2b5-618e370b0000 pid=2871 execve guuid=a55dcdac-1b00-0000-a2b5-618e380b0000 pid=2872 /tmp/sample.bin net send-data zombie guuid=112381ac-1b00-0000-a2b5-618e370b0000 pid=2871->guuid=a55dcdac-1b00-0000-a2b5-618e380b0000 pid=2872 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=a55dcdac-1b00-0000-a2b5-618e380b0000 pid=2872->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/45f57882-2959-4f99-b582-f7751d7fcacf
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3/
Threat name:
Linux.Backdoor.Rekoobe
Create hunting rule
Status:
Malicious
First seen:
2023-09-23 04:31:20 UTC
File Type:
ELF64 Little (Exe)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qbufi36cb4f6he27jhp42cjywghkfauee76rbebl2m772ul2yxrq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260622-tbzq4sd12p/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Trojan_Rekoobe_de9e7bdf
Create hunting rule
Author:Elastic Security
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rekoobe

elf 8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874442/
  
Delivery method
Distributed via web download

Comments