MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d570a1702448fac805fe39e9a49fd1ca24e4505161eec68cf6e7f5e2b6a34ce0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | d570a1702448fac805fe39e9a49fd1ca24e4505161eec68cf6e7f5e2b6a34ce0 |
|---|---|
| SHA3-384 hash: | 578185189139ffd7f1cda59c0b100db2d16c91a7be14b3d406560ee096cccb13a4be17463bcd905d4121b643e775c04c |
| SHA1 hash: | cda7e856dad15d6959de895717eb27a94176d176 |
| MD5 hash: | 49d89fc88c986465074916dd18411074 |
| humanhash: | colorado-asparagus-alpha-salami |
| File name: | mipsle |
| Download: | download sample |
| File size: | 39'846'043 bytes |
| First seen: | 2026-10-16 16:34:19 UTC |
| Last seen: | 2026-10-17 04:14:08 UTC |
| File type: | elf |
| MIME type: | application/x-executable |
| ssdeep | 98304:D0tTePaKRew12kac1bpLk5b1Dq6BzUX3YarVbrzvAnoG7PHjQFX6dBl5TJ1VhRgZ:AtTe9RepknLk5BGhqoiPHj40n8e8/3FN |
| TLSH | T1B197B3059CC42ABBC46C0EB060DF897A7A209D189FE20B6B5465F9D9B8753317F5BC8C |
| gimphash | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| Magika | elf |
| Reporter |  BlinkzSec |
Intelligence
File Origin
# of uploads :
2
# of downloads :
82
Origin country :
DEVendor Threat Intelligence
No detections
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Connection attempt
Creating a process from a recently created file
Sends data to a server
Receives data from a server
Runs as daemon
Verdict:
Unknown
File Type:
elf.32.le
First seen:
2026-10-16T15:10:00Z UTC
Last seen:
2026-10-17T09:34:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
ELF
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
elf d570a1702448fac805fe39e9a49fd1ca24e4505161eec68cf6e7f5e2b6a34ce0
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.Family: Legea (named after the protocol verb 'legea=<method>', the only author string in the memory dump; 124 hits in memory, 0 on disk). Go 1.24 DDoS bot with a control plane, obfuscated with garble -literals plus a falsified Go header (gopclntab magic / textStart / buildinfo) that makes decompilers reject the file. 13 methods confirmed live: 9 floods (udpflood udpsmart tcpflood tcphandshake synflood ackflood greflood http dns) + rce/persist/lock/kill. C2 130.12.180.32:7001 plus 7 hardcoded fallback domains. Does not self-propagate. No public family label on any engine so far. Full analysis: https://blog.efespain.com/en/chapter-32/ | how it was delivered: https://blog.efespain.com/en/chapter-31/