MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81
SHA3-384 hash: 8d75cb6a524e88c445224faf69a21e91b87e34b1d294193934803d39dfec9fcd456519afaa24754e4cfbc8a77a0b8371
SHA1 hash: 2415990fc613cafe49ba9266c9ccd950c5dcacec
MD5 hash: b21427e7f2f91ee5c12febeb378b0ffc
humanhash: jig-papa-aspen-floor
File name:bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81
Download: download sample
File size:883'248 bytes
First seen:2026-07-02 10:33:04 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 24576:uDmwgzFO5mkE3TgHlU8w0kV1pQ0dxkL1jZOm:YmpE5mk0gFhw0kjplxkL19/
TLSH T15C156C06EA0155B9D07271B1524FE336C8686B358527488FFF5A2D6CEA3A2D09F3C397
telfhash t107d27cb33ebe58ed33a0a805d70a2b52ee0ad67358e435f645f3558532b3e429e71831
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter JAMESWT_WT
Tags:criminalcloudflare-online elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
Sets a written file as executable
Creating a file in the %temp% directory
Changes access rights for a file
Deleting a recently created file
Launching a process
Connection attempt
Creating a file
Changes the time when the file was created, accessed, or modified
Changes access rights for a written file
DNS request
Traces processes
Substitutes an application name
Deletes a system binary file
Creates or modifies files in /cron to set up autorun
Creates or modifies files in /init.d to set up autorun
Deleting of the original file
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
true
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
158
Number of processes launched:
9
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81
Behaviour
Anti-VM
Persistence
Process Renaming
Anti-Debugging
Information Gathering
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-07-02T10:07:00Z UTC
Last seen:
2026-07-02T10:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b6a4d6bf-f5e4-4f05-b6e8-b7efb548477e
Behavior Graph:
Download SVG
%3 guuid=45aecdbd-1e00-0000-9f1b-c6d7d30b0000 pid=3027 /usr/bin/sudo guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034 /tmp/sample.bin delete-file write-file guuid=45aecdbd-1e00-0000-9f1b-c6d7d30b0000 pid=3027->guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034 execve guuid=435c2cc0-1e00-0000-9f1b-c6d7dc0b0000 pid=3036 /tmp/sample.bin guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034->guuid=435c2cc0-1e00-0000-9f1b-c6d7dc0b0000 pid=3036 clone guuid=5b0f99c1-1e00-0000-9f1b-c6d7e20b0000 pid=3042 /tmp/sample.bin guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034->guuid=5b0f99c1-1e00-0000-9f1b-c6d7e20b0000 pid=3042 clone guuid=68f4b2c1-1e00-0000-9f1b-c6d7e40b0000 pid=3044 /tmp/sample.bin guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034->guuid=68f4b2c1-1e00-0000-9f1b-c6d7e40b0000 pid=3044 clone guuid=338fd7c1-1e00-0000-9f1b-c6d7e50b0000 pid=3045 /tmp/sample.bin guuid=fc4d09c0-1e00-0000-9f1b-c6d7da0b0000 pid=3034->guuid=338fd7c1-1e00-0000-9f1b-c6d7e50b0000 pid=3045 clone guuid=22e0e0c1-1e00-0000-9f1b-c6d7e60b0000 pid=3046 /tmp/sample.bin guuid=338fd7c1-1e00-0000-9f1b-c6d7e50b0000 pid=3045->guuid=22e0e0c1-1e00-0000-9f1b-c6d7e60b0000 pid=3046 clone guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047 /tmp/sample.bin dns net send-data write-file guuid=22e0e0c1-1e00-0000-9f1b-c6d7e60b0000 pid=3046->guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047 clone 80639f7d-8d8e-5d60-8819-65337bb0e774 criminalcloudflare.online:1337 guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->80639f7d-8d8e-5d60-8819-65337bb0e774 con ae59d690-31db-5cf6-bdf7-6b51c565171f dhdsjsdjxc.duckdns.org:1337 guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->ae59d690-31db-5cf6-bdf7-6b51c565171f con 72ee4825-3a34-54da-9966-65f4c544038b fcfrfxrfrsfs5f.duckdns.org:1337 guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->72ee4825-3a34-54da-9966-65f4c544038b con a0528efd-1018-56b4-b518-221acb0fa7ca 9.9.9.9:53 guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->a0528efd-1018-56b4-b518-221acb0fa7ca send: 381B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 381B guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3049 /tmp/sample.bin guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3049 clone guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3050 /tmp/sample.bin guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3047->guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3050 clone guuid=8d9c76be-2500-0000-9f1b-c6d767140000 pid=5223 /tmp/sample.bin guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3049->guuid=8d9c76be-2500-0000-9f1b-c6d767140000 pid=5223 clone guuid=fae2bcba-2c00-0000-9f1b-c6d76a140000 pid=5226 /tmp/sample.bin guuid=de99eac1-1e00-0000-9f1b-c6d7e70b0000 pid=3049->guuid=fae2bcba-2c00-0000-9f1b-c6d76a140000 pid=5226 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f135e9ce-7ba5-4c3b-8668-096154667474
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-22 19:33:48 UTC
File Type:
ELF32 Little (Exe)
AV detection:
6 of 38 (15.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xw4qlu6puamm7ss26cg3a3pxnsknvmfwffovozzbkczf6wibbsaq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260702-mlwc4sf15t/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Changes its process name
Reads process memory
Creates/modifies Cron job
Enumerates running processes
Modifies init.d
Reads MAC address of network interface
Deletes itself
Traces itself
Unexpected DNS network traffic destination
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:test_rule_vldslv
Create hunting rule
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments