MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490
SHA3-384 hash:	bbd80650ed45eabc5dbfe6552f0e5d6fa40a41b4297341eb955677800421c7a36f97e745f5f55bf35b4bef491a2d6346
SHA1 hash:	7556ee2fe658448362cd47a9b3282aa0b6637c51
MD5 hash:	5f50fe14443f0379e94def463868b51c
humanhash:	wisconsin-tennis-mountain-queen
File name:	boatnet.i686
Download:	download sample
File size:	6'540 bytes
First seen:	2026-05-01 17:56:39 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	192:fFhjtI5RfFfbLEbrVa/MX+v0EqmKyokedsYVQA:f76tzIbF+vomW/dMA
TLSH	T1B2D1E743B68BCDF2D48A00784807773ED324AA4CB114DFABF748EAA1D9B368D1516397
telfhash	t181c02b0010b0d42c4cd30fb49ca506aab1001020580bcb00c8106f90f43f880d00cf57
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 000c6aaff73ab8b86bced644636aace5c1a1dbbaf938135216e426f5db96eeab

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	5'632 bytes
File size (de-compressed) :	6'540 bytes
Format:	linux/i386
Packed file:	000c6aaff73ab8b86bced644636aace5c1a1dbbaf938135216e426f5db96eeab

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Linux.Mirai.10456.22426.25231.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/69f4e988df14f1cb2ac7c7b9/reports/a0db4463-6714-45b1-9312-edca511638c7/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Unknown

File Type:

elf.32.le

Link:

https://opentip.kaspersky.com/c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1157b2d2-0550-4293-8171-ab704171ab3e

Behavior Graph:

Download SVG

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bca67f9d-66fd-4f72-90f9-ee83e8183a23

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1907417

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yk2lbcqv5wamyhwlrixebxo45t4rg4cmyqp3ilignn2pexbfwsia._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260501-wjtwyaax3y/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/