MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079
SHA3-384 hash:	215413cfd1f9d95469c4484e3d56c415d3d6ab245645847f3d15b86680d6139ff976ae9ac550b9d3e70d987844a7f326
SHA1 hash:	7a2dcc25db7bb12dacf1be04c0a80a6b88f87d59
MD5 hash:	37f3856393001e65fe50c0831013e744
humanhash:	ack-delaware-alaska-purple
File name:	5
Download:	download sample
File size:	374'924 bytes
First seen:	2026-05-14 19:28:11 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:teZ6bP+UEbP8dbXefzKXAwMePYYfMfuWmb9J+C53se3XXF73mH7H+HeaGMFMvQOQ:QZ6bP28dbXerKXAwXPYYfMHCue3XpmHQ
TLSH	T17D842334FAD633A69A3E32E93D59F993F8645DEF31AC30541264B19BE4053F281099CD
Magika	elf
Reporter	BlinkzSec
Tags:	UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	374'924 bytes
File size (de-compressed) :	840'308 bytes
Format:	linux/mips
Unpacked file:	04e390688d9f52d33c25e7e0bf6b5068ee47411f67a16fbf2224a5b9b72372c4

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8f8cf52f-63bf-4f2b-ad3f-71924fd3ac93/

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Gathering data

Verdict:

Unknown

File Type:

elf.32.be

First seen:

2026-05-09T03:05:00Z UTC

Last seen:

2026-05-09T03:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f204159c-22a9-42a2-a65a-7b5476da0aaf

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e0d93256-b512-4d27-9b83-e7576966a62c

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqri3i6zb7yzotm5jui6vc5moacwoqt2lm7ilopoqtcijnfd6b4q._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/260514-x622haat2s/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/