🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AVERAT


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47
SHA3-384 hash: fd2e28d6425708dd518472afc35eb103b4a717a60dd913c2d7fc8016f03328ee28a1983c2d122069d709242433c9b923
SHA1 hash: a32f5b6c711929b8ec5e4ea52dfa1c35fe3b3733
MD5 hash: e8ccbc746fd4a7dfc161a8e268e468fa
humanhash: ink-friend-spaghetti-uranus
File name:agetty
Download: download sample
Signature AVERAT
Create hunting rule
File size:74'208 bytes
First seen:2026-10-03 19:17:44 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:jx57zW/6x8V9cMGBibXfdChQM8i6YeUPszYVHyWEP1V7B2+gfNugBz+Li:jbWSxXMGibMCn0hU1VFBZ
TLSH T10C733A03FD5088BDC49ADB74CF0ED02A4AFAB1897217B51B29106E643E47F255F0EB66
telfhash t17a017b09d53d8f6e41a1ed748c1447e341c7a3264072d610ff58e9d49c3e406f118c4f
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter smica83
Tags:Averat elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.ELF.Rekoob-K.67947541.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Runs as daemon
Connection attempt
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
gcc golang
Link:
https://www.filescan.io/uploads/6ac154fdcc43dae00da941c2/reports/230f1c73-f03d-45b8-ab30-e81554255b5d/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2025-11-28T01:46:00Z UTC
Last seen:
2026-03-18T02:00:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/00bf3555-c74e-47e5-be06-60cc4b56294f
Behavior Graph:
Download SVG
%3 guuid=957d098b-1b00-0000-421e-29f4f1090000 pid=2545 /usr/bin/sudo guuid=3b41f68d-1b00-0000-421e-29f4f9090000 pid=2553 /tmp/sample.bin guuid=957d098b-1b00-0000-421e-29f4f1090000 pid=2545->guuid=3b41f68d-1b00-0000-421e-29f4f9090000 pid=2553 execve guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2555 /tmp/sample.bin guuid=3b41f68d-1b00-0000-421e-29f4f9090000 pid=2553->guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2555 clone guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2557 /tmp/sample.bin guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2555->guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2557 clone guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2558 /tmp/sample.bin guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2555->guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2558 clone guuid=a069138f-1b00-0000-421e-29f4ff090000 pid=2559 /tmp/sample.bin dns net send-data guuid=0e47b58e-1b00-0000-421e-29f4fb090000 pid=2558->guuid=a069138f-1b00-0000-421e-29f4ff090000 pid=2559 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=a069138f-1b00-0000-421e-29f4ff090000 pid=2559->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 64B cbf5d86a-0445-56b7-a43a-18d818ac0733 36.230.84.237:25 guuid=a069138f-1b00-0000-421e-29f4ff090000 pid=2559->cbf5d86a-0445-56b7-a43a-18d818ac0733 con
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/58a59bcd-d72e-4209-997b-61cc4f4d4081
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1981763
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1981763 Sample: agetty.elf Startdate: 03/10/2026 Architecture: LINUX Score: 56 16 169.254.169.254, 80 USDOS-USDepartmentofStateUS ZZ 2->16 18 36.230.84.237, 25 HINETDataCommunicationBusinessGroupTW Taiwan 2->18 20 mx.zxopfds.com 2->20 22 Antivirus / Scanner detection for submitted sample 2->22 24 Multi AV Scanner detection for submitted file 2->24 8 agetty.elf 2->8         started        10 python3.8 dpkg 2->10         started        signatures3 process4 process5 12 agetty.elf 8->12         started        process6 14 agetty.elf 12->14         started       
Score:
98%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47/
Threat name:
Linux.Trojan.Rekoob
Create hunting rule
Status:
Malicious
First seen:
2025-11-28 06:32:08 UTC
File Type:
ELF64 Little (Exe)
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x6atl5doz3p6lpig7twlwltsdqrwp73wlmmpjkr7q2hglf7utzdq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/261003-xz2gdswapa/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.rapid7.com/blog/post/tr-smtp-is-the-key-bpfdoor-averat-hitting-the-network-edge/

Comments