MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rekoobe


Vendor detections: 10


Intelligence 10 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f
SHA3-384 hash: 4c56a5030b754c8d884180f7ed259791cc6b795b46e5cafc52eb27f6c73ee2273fd71c84c74b213e2647f3955569056b
SHA1 hash: 25ff6b77ff24d2267ceced55b707f6b3b2cb1c95
MD5 hash: be57570e68bc503887a5d8c16aeae6e7
humanhash: seven-ack-illinois-magnesium
File name:sshd64
Download: download sample
Signature Rekoobe
Create hunting rule
File size:86'176 bytes
First seen:2025-12-10 13:45:22 UTC
Last seen:2025-12-13 06:31:49 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o
TLSH T110836C43B6668DBEC859C2304F0FA436A873BD58EF66321B34405B64392FB192F29765
telfhash t116019e47d93d479449961d24dcac13e38143d21ad0669b04ff24cdc004ae40af218c4f
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter smica83
Tags:check-office365-update-com elf Rekoobe

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
Noodle
Details
Noodle
a configuration RC4 key, c2 socket address(es), days of the week and hour ranges the malware will run, and an interval
Link:
https://research.acce.ciphertechsolutions.com/results/d67f320b-012a-42ba-9ff4-3c2bc1ab586b/
Detection(s):
Unix.Trojan.Backdoor-6678692-0
Create hunting rule

Verdict:
Malicious
File Type:
elf.64.le
First seen:
2025-12-05T11:26:00Z UTC
Last seen:
2025-12-05T11:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3c2159b1-3661-43f2-a8df-75abe5cee68d
Result
Threat name:
Rekoobe
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1830248
Signature
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Rekoobe
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f/
Threat name:
Linux.Backdoor.Rekoobe
Create hunting rule
Status:
Malicious
First seen:
2025-12-05 18:40:11 UTC
File Type:
ELF64 Little (Exe)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ryd35ocu657jbqluqkn5jya6qz3z2wlhccwrmhn4bybkegowej7q._file
Result
Malware family:
rekoobe
Create hunting rule
Score:
  10/10
Tags:
family:rekoobe linux
Link:
https://tria.ge/reports/251210-q23nxaxrdj/
Malware Config
C2 Extraction:
CHECK.OFFICE365-UPDATE.COM:8081
Verdict:
Malicious
Tags:
trojan rekoobe Unix.Trojan.Backdoor-6678692-0
YARA:
Linux_Trojan_Rekoobe_de9e7bdf
Link:
https://app.threat.zone/submission/bdae0d88-726f-4bf8-b6ee-46aebde58ae2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:Linux_Backdoor_NoodRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects NoodRAT backdoor.
Rule name:Linux_Trojan_Rekoobe_de9e7bdf
Create hunting rule
Author:Elastic Security
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments