🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f
SHA3-384 hash: 38524db4cb6084467d4ccc0d4ce9208382076624e857a35a131fc3b7138108a5d101763ddab7e8f2c637c6b4a4594919
SHA1 hash: 7da29205038c571492227eda3e1c06700bef1b87
MD5 hash: 92714ddfa2d68e6f268c888e91be0bd3
humanhash: london-nebraska-october-xray
File name:poop
Download: download sample
File size:1'023'299 bytes
First seen:2026-09-03 15:32:46 UTC
Last seen:2026-09-03 22:29:33 UTC
File type: elf
MIME type:application/x-executable
ssdeep 24576:8xjYKXhddU2aABFkxaU1D6tFrGQhl4PRecoNy53r8Nioi5+AWk66:8+KxdmybkoU1DgFlNcCyNfP
TLSH T16C2533B0DB75A149FD593D7E08F458749E2D3C4936FBDF61CCA0A90825AFD0A8A4E90C
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
3
# of downloads :
52
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a99933a12ef468f09d2920d/reports/ebe67299-045d-4ebb-81dd-b0f3675b32fd/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
custom
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d3cf8e9d-1a86-4ac4-92dd-afdac2952c24
Behavior Graph:
Download SVG
%3 guuid=bd364063-1800-0000-f556-b54f760a0000 pid=2678 /usr/bin/sudo guuid=6b07e269-1800-0000-f556-b54f7d0a0000 pid=2685 /tmp/sample.bin guuid=bd364063-1800-0000-f556-b54f760a0000 pid=2678->guuid=6b07e269-1800-0000-f556-b54f7d0a0000 pid=2685 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/46b34e82-6a02-40a4-80a2-eaabc0c9aca8
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1968126
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y26uhk25tbyvw32pbfa74dp66k5qj7fz7onwuuk7i4pmyra7cv7q._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260903-szaw8awyat/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf c6bd43ab5d98715b6f4f0941fe0dfef2bb04fcb9fb9b6a515f471ecc441f157f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3911414/
  
Delivery method
Distributed via web download

Comments