MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46
SHA3-384 hash: ab5e7bf4cc3027eab4b270a3c559ad8403fe4d6ef5f758bce4792a9c24e17e16b43e291e75d3b4844bf63d92174d87a6
SHA1 hash: 997958d06a0acbab02c3b13e8593412829803469
MD5 hash: 94252bd84e9734294b0ffc4ab04f8aaf
humanhash: xray-tango-robert-seventeen
File name:main.mips64r6el-n32
Download: download sample
File size:140'260 bytes
First seen:2026-08-11 01:26:46 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:zZyGoQvGYZmvr38b18ZwfJLXI5Po86ErEbo:8SeYhSZucQ8TEbo
TLSH T107D31A05EE047AB7D09E8E7845BFC19204D53DF7A2D4C33976E86A8D7A3C65906C3B88
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-08-10T23:43:00Z UTC
Last seen:
2026-08-12T19:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6c8fa9a5-330c-4f35-a820-96a7bde275c3
Behavior Graph:
Download SVG
%3 guuid=20a14a82-1a00-0000-96dd-f60bcc080000 pid=2252 /usr/bin/sudo guuid=bcd44784-1a00-0000-96dd-f60bcf080000 pid=2255 /tmp/sample.bin guuid=20a14a82-1a00-0000-96dd-f60bcc080000 pid=2252->guuid=bcd44784-1a00-0000-96dd-f60bcf080000 pid=2255 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d82a5c54-138c-430e-8761-aaaaea717180
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1955523
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3mqrjdfs6rql6i56kcbzom3vizb642mrnmmgv5tzeymskheapjda._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/260811-bvabfssgjg/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf db21148cb2f460bf23be50839733754643ee69916b186af6792619251c807a46

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898662/
  
Delivery method
Distributed via web download

Comments