MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a40a6be2aa18ef5d42f16d01d8b5f388b71c4554e2f313fcd8e397c2fded138f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments

SHA256 hash:	a40a6be2aa18ef5d42f16d01d8b5f388b71c4554e2f313fcd8e397c2fded138f
SHA3-384 hash:	72f99cbaf4ed124f48338b92dded44f73b1f631bdf0456d40a764cf8559d2d582d6fcf2c7971424bcc6072630135f809
SHA1 hash:	1186049afe690dd62bb0b9ff26a7f2fb998ead6c
MD5 hash:	4e0492b50b5ac03213d750b8e89c14df
humanhash:	coffee-sixteen-fillet-twelve
File name:	mpsl
Download:	download sample
File size:	80'960 bytes
First seen:	2026-09-25 15:37:25 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:HQDVq2Ze+WaXoHbwVsXFzWsgZatKNfEphek9e3W8GDlEM89+e:QPTabOpatxkmgn
TLSH	T1DA832906EB514EFBD8AFCE3345BA0B0231CC595723F52B3A3674D928B54A14B5AD3C68
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 934586673c04f504e861d7d5415e4aa427108c807715d69dbd8fc7a467df1d4c

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	36'724 bytes
File size (de-compressed) :	80'960 bytes
Format:	linux/mipsel
Packed file:	934586673c04f504e861d7d5415e4aa427108c807715d69dbd8fc7a467df1d4c

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sends data to a server

Receives data from a server

Runs as daemon

Kills processes

Connection attempt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6ab695693105b9e9d0e95ad5/reports/8207bcba-f7a0-41c7-a25e-69e865beb6a6/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/639bb0da-a449-44e3-b42a-1a8a31e4e4a4

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2a09cfd9-0147-41b1-9ce6-e9a2bb343b91

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1978277

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a40a6be2aa18ef5d42f16d01d8b5f388b71c4554e2f313fcd8e397c2fded138f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a40a6be2aa18ef5d42f16d01d8b5f388b71c4554e2f313fcd8e397c2fded138f/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uqfgxyvkddxv2qxrnua5rnptrc3ryrku4lzrh7gy4ol4f7pncohq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/260925-s24x3svwg1/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/