MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dofloo

Vendor detections: 9

Intelligence 9 IOCs YARA 12 File information Comments

SHA256 hash:	dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e
SHA3-384 hash:	1c4dcdd036b9a631d502b1fc513652b409c86d2b2320f39b895206a866302c74802358d088bcbda821c552b35098596e
SHA1 hash:	ad096ea7b9a7fe4fd9c6359964fd5ab0bb4004ea
MD5 hash:	1d4a2d1ca1a9fcb7ae832744c6e4edae
humanhash:	fourteen-stairway-july-wolfram
File name:	uux
Download:	download sample
Signature	Dofloo Create hunting rule
File size:	1'870'048 bytes
First seen:	2026-09-30 16:27:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	49152:bNihhOhBNhKhyu7cYx9z2rAnKsfR2aFyZB5Ss5+Nu:5ihhOhBNhKhRwwJ2ro0aFyZB5Ss5+Nu
TLSH	T17C85BFCEEB8294B7C56B0A7005DBD77A2330E938805F4F576A9DCD78B817990BD0EA05
telfhash	t1fc511156683c12c9d9a26c048cb12fd3548be2793395ea09fb6bcec018ce959f578c0f
Magika	elf
Reporter	adliwahid
Tags:	Dofloo

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Spike-6301360-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Collects information on the CPU

Collects information on the network activity

Receives data from a server

Sends data to a server

Runs as daemon

Connection attempt

Launching a process

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

gcc

Link:

https://www.filescan.io/uploads/6abd39cb4fe3f3fb880ba55b/reports/8211e0d8-1ea3-47a3-a7f0-07eb7c1cc0e1/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-09-30T14:31:00Z UTC

Last seen:

2026-09-30T23:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4a73cee1-0a13-480d-9661-1a8c1937afa6

Behavior Graph:

Download SVG

Malware family:

DDOS.TF

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7e614d13-8870-4ffd-af4f-f96c91cc4fa9

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e/

Threat name:

Linux.Trojan.Dofloo

Status:

Malicious

First seen:

2026-09-30 16:28:24 UTC

File Type:

ELF32 Little (Exe)

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=33rawf2ol5wrdlsky6h4pnmttyiuizeht3n4iwr25frnys3sqmxa._file

Result

Malware family:

mrblack

Score:

10/10

Tags:

family:mrblack antivm botnet discovery linux trojan

Link:

https://tria.ge/reports/260930-tyrn1sxy9m/

Behaviour

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

Reads system network configuration

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/dee20b174e5f6d11ae4ac78fc7b5939e114464879edbc45a3ae962dc4b72832e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_lsls Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	CN_disclosed_20180208_lsls_RID2FCC Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	F01_s1ckrule Create hunting rule
Author:	s1ckb017

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	LinuxAESDDoS Create hunting rule

Rule name:	Rooter Create hunting rule
Author:	Seth Hardy
Description:	Rooter

Rule name:	RooterStrings Create hunting rule
Author:	Seth Hardy
Description:	Rooter Identifying Strings

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample