MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986
SHA3-384 hash:	9dedfc9529552c3c8bfdba8ccb6b3963b9416b7403655df9dc957953de5281bbed43f6898f6c347f6bddc90b889a44c6
SHA1 hash:	5199a12b787593881b894daef48dfcc3e41d48c1
MD5 hash:	eb4411c70ee41e6e46c99e43f312a80e
humanhash:	texas-don-wolfram-pluto
File name:	perc.x86
Download:	download sample
File size:	4'268'158 bytes
First seen:	2026-07-25 12:16:47 UTC
Last seen:	2026-07-25 13:25:42 UTC
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	98304:ZWZhEHiXLOqg/wRFLZJsAvifBSfSS/vgm/+tE1Cpr:IZXrtlssfvvgXS1g
TLSH	T19016337451B0D8377145BF771D76B8553B0A8208317A7E2A27B1E9ED012A81B3F0BBE5
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

67

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file

Sends data to a server

Receives data from a server

Collects information on the CPU

Collects information on the RAM

Connection attempt

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6a64a935934bbe9eeeda7971/reports/667bf0c4-876e-4e40-bd2b-6a42753233fc/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

75

Number of processes launched:

4

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986

Behaviour

Anti-VM

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/eda17cf4-cb71-463d-a036-c9b8681ed1f4

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ce2f3d07-099e-47f4-baa9-70bf2c4a88e1

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

troj

Score:

24 / 100

Link:

https://www.joesandbox.com/analysis/1947917

Signature

Sample reads /proc/mounts (often used for finding a writable filesystem)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qdv35zlqtbkfdwmom7u2ic3ugy3oyj4u3crrd6ru4cukly5uxgda._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260725-pfymdsak5t/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Checks CPU configuration

Checks hardware identifiers (DMI)

Enumerates running processes

Reads hardware information

Reads list of loaded kernel modules

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.