MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 5 File information Comments

SHA256 hash:	e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919
SHA3-384 hash:	eb86ab43126190a722953a49b99b2faa12569e30f2fa1d1970763c8d80758529c9a53da69d3ce10ba6b5426579a58faa
SHA1 hash:	8af0d31bdd2f1956934d3f83465fbdf1d4e95bd3
MD5 hash:	33d9931b3b100965eac34064e86eca2c
humanhash:	kentucky-ohio-winter-mexico
File name:	ppc
Download:	download sample
File size:	182'868 bytes
First seen:	2026-10-03 23:14:21 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:HCxMH44KBUa71ypvkb1xM5bhdFwN+45rRRjwwx:HCxMH44g1ypvC1xM5bhdFwlFp
TLSH	T12D046C06771C0D83E15B4EF03B3F5BE093AF966121E6B140240FAF89D1B1E765A86DDA
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 39a229dcaaa009a5bf84a49037f69fe45c90558a01bb8e43fbb9676961897e24

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	68'352 bytes
File size (de-compressed) :	182'868 bytes
Format:	linux/ppc32
Packed file:	39a229dcaaa009a5bf84a49037f69fe45c90558a01bb8e43fbb9676961897e24

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Mirai-10012200-0

Unix.Trojan.Mirai-10012671-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Receives data from a server

Runs as daemon

Connection attempt

Kills processes

Sends data to a server

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac18c9a6d1510f4c1949688/reports/dd77c938-2cf7-4035-8ed0-763aa33e9547/overview

Verdict:

Unknown

File Type:

elf.32.be

First seen:

2026-10-04T02:04:00Z UTC

Last seen:

2026-10-04T23:46:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/85aad328-6a60-4c84-9612-8533d89fcaac

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/17a75797-2219-4e67-bace-3a9d9cf93498

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1981792

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4fkjr5nfkc3owwj4jqy45dzj2liompv64ujhxtntkco4tqrnzemq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261003-28re1azv7m/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e15498f5a550b6eb593c4c31ce8f29d2d0e63ebee5127bcdb3509dc9c22dc919

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/