MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d
SHA3-384 hash:	8c45df3e236d7289d4dbf1aad997d4f291132ef1a8c0d5508d4c05e8a2ffa5b017f5354e0c3b2d8330ceaeeb139cd290
SHA1 hash:	7895e722c813f5bdc3c5615b50392a1cf9a635fe
MD5 hash:	eaeaf05e1b0b460d10d572eea45b720b
humanhash:	texas-hydrogen-cola-coffee
File name:	i686
Download:	download sample
File size:	145'496 bytes
First seen:	2026-10-03 18:07:24 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:m7qXMp16EqmkyBdfntuoIOUIyk46KFMYnvfqFvALKPdlAoW5ibcCar6lPB0BLGJY:m7q8WU//yk453vfEvcyEYbcCaug1X
TLSH	T109E30744FB87E0F7C40389B15078B37B8B318B1D5033D96ADB996F55B9E6E00936A268
telfhash	t1395159fbfea60ddc6bd49901c7cf1b11de0ee27b292035b509e201d436b18a090b8c79
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 90458c304fba58654a0cf92b93efe7302accb9dfa9ec5d053dd4471aa0810d37

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	54'428 bytes
File size (de-compressed) :	145'496 bytes
Format:	linux/i386
Packed file:	90458c304fba58654a0cf92b93efe7302accb9dfa9ec5d053dd4471aa0810d37

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Clean

Maliciousness:

Behaviour

Receives data from a server

Sends data to a server

Kills processes

Runs as daemon

Connection attempt

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac14498af54e52581017421/reports/413f66e4-ac0d-4ed8-869b-c3db1ef27169/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Unknown

File Type:

elf.32.le

First seen:

2026-10-03T17:00:00Z UTC

Last seen:

2026-10-04T23:46:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2cda059c-1ff1-4e71-956c-864d1e32edd2

Behavior Graph:

Download SVG

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a822c6bf-db64-432b-b09a-5cb99e8b5e22

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1981759

Signature

Malicious sample detected (through community Yara rule)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3qjydutnkt6ijotyk7zt53vqmyofd264hhfs7d2o7uhpjeamp6gq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261003-wq1casvv6l/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dc1381d26d54fc84ba7857f33eeeb0661c51ebdc39cb2f8f4efd0ef4900c7f8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	Linux_Trojan_Mirai_cc93863b Create hunting rule
Author:	Elastic Security

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/