MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 df1765629fd2968e5dab6530712477ed728a56a59310ad225d25eb046fdf357c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | df1765629fd2968e5dab6530712477ed728a56a59310ad225d25eb046fdf357c |
|---|---|
| SHA3-384 hash: | 349c2983bffacf445e6e4e52647c886fecbb27b64cc16f0812cdbb82967a4a56abf35bf56111ec4924d38c32ee0dd6d0 |
| SHA1 hash: | e037a6e5f2e010f396932a0496549322f8d6ec3a |
| MD5 hash: | b8a04bd450a0e75ef46c11ba49a5f354 |
| humanhash: | nevada-juliet-april-jupiter |
| File name: | x86_64 |
| Download: | download sample |
| File size: | 2'450'924 bytes |
| First seen: | 2026-02-25 16:12:05 UTC |
| Last seen: | 2026-02-25 16:24:09 UTC |
| File type: | elf |
| MIME type: | application/x-executable |
| ssdeep | 49152:kvPZwgMyltjd0cxCGz3vq9QceT7UbsDxFdrs6+RGz:kvqgTTjNkyTHDxbr9rz |
| TLSH | T199B533341E0131ABEF3F704A6A2E86DA7A45FEC3345CAA38484317AF5105B914ED5FB2 |
| TrID | 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1) |
| Magika | elf |
| Reporter |  abuse_ch |
| Tags: | elf UPX |
UPX packed
This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.
| File size (compressed) : | 2'450'924 bytes |
|---|---|
| File size (de-compressed) : | 8'443'816 bytes |
| Format: | linux/amd64 |
| Unpacked file: | 28beeb84738834b6c91be39dceee8a0d7e68e9c84d0e66ed4b77e0e84baa4a28 |
Intelligence
File Origin
# of uploads :
2
# of downloads :
67
Origin country :
DEVendor Threat Intelligence
No detections
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Connection attempt
Changes access rights for a written file
Sends data to a server
Launching a process
Creating a file in the %temp% directory
Collects information on the CPU
Receives data from a server
Creating a file
Collects information on the OS
Runs as daemon
Creating a process from a recently created file
Changes the time when the file was created, accessed, or modified
Creates or modifies files in /cron to set up autorun
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
63
Number of processes launched:
13
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.64.le
Status:
terminated
Behavior Graph:
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
56 / 100
Signature
Executes the "crontab" command typically for achieving persistence
Multi AV Scanner detection for submitted file
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
ELF
Threat name:
Linux.Trojan.Generic
Status:
Suspicious
First seen:
2026-02-25 16:12:43 UTC
File Type:
ELF64 Little (Exe)
AV detection:
3 of 36 (8.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
6/10
Tags:
discovery execution linux persistence privilege_escalation upx
Behaviour
GoLang User-Agent
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Reads CPU attributes
Creates/modifies Cron job
Enumerates running processes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
elf df1765629fd2968e5dab6530712477ed728a56a59310ad225d25eb046fdf357c
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.