MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f
SHA3-384 hash: f5971efd438fdeba2dc15c9191b673f65a20d9fdc37c6309fb70614bc60f88ca7522e317d1f94b502f10e483bfb904f7
SHA1 hash: d15a12199acda3b8cecaed8e3f082eabe5df3481
MD5 hash: 7e00ecb5f2cf6fc41eaf5d427854b7fa
humanhash: rugby-blossom-island-muppet
File name:jbd2_sda1d
Download: download sample
File size:1'731'832 bytes
First seen:2026-07-26 10:55:55 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 49152:TmW5sUPRMzfXkVrp2YExhcKsROzGxEdJuaHl:lsXphzdMS
TLSH T10A853334C541835BAEC48EFDEC593A9381762881C6204BD405F0FA64596FFAD70FBAB9
telfhash t13b9002d0024440ef341491b0a6d5e30780b0111f20246c63970411cc1441d954901436
Magika elf
Reporter adliwahid
Tags:UPX
File size (compressed) :1'731'832 bytes
File size (de-compressed) :6'160'532 bytes
Format:linux/arm
Unpacked file: e7c5c267b91264af2a1b5c68a9b3a03adc48fca730a0cd2bea0740646cbd5b67

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/6a65e898dc3ea88a785f03c6/reports/2f91af88-6bb5-489b-b924-02699c214c53/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/950c19ff-c10c-46ab-9a84-563df6751d65
Behavior Graph:
Download SVG
%3 guuid=32a2551f-2000-0000-44d9-dcc22d0a0000 pid=2605 /usr/bin/sudo guuid=71f78d21-2000-0000-44d9-dcc22e0a0000 pid=2606 /tmp/sample.bin guuid=32a2551f-2000-0000-44d9-dcc22d0a0000 pid=2605->guuid=71f78d21-2000-0000-44d9-dcc22e0a0000 pid=2606 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/73c1b207-ab18-4ba3-a4ea-b65e6ae8485a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yrf7kvw3v5jlpg7nbym6syvalvemrpoleyisvddsrdim3p4eiyhq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence privilege_escalation upx
Link:
https://tria.ge/reports/260726-m2s8pateja/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Creates/modifies Cron job
Enumerates running processes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

elf c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f

(this sample)

elf e7c5c267b91264af2a1b5c68a9b3a03adc48fca730a0cd2bea0740646cbd5b67

  
Dropping
SHA256 e7c5c267b91264af2a1b5c68a9b3a03adc48fca730a0cd2bea0740646cbd5b67
  
Dropping
MD5 2c8530dfcd92466d46ce6611bf3f2e9f

Comments