MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7
SHA3-384 hash:	5c1c14abde28e2820f7bcf5ee9e83110c0d1f23a127b845ebb6be124acf26778f819d7b3311f2e7f68feb5252001f5ee
SHA1 hash:	c426630b59aa7ff1bb58ad2932c38a6727a42f07
MD5 hash:	2325a294d923b65cfe1e2e367cce6038
humanhash:	fruit-ack-batman-thirteen
File name:	vc1
Download:	download sample
File size:	9'663'940 bytes
First seen:	2026-04-25 15:03:19 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	196608:tCyokIgn/V/W6LCbpZVhvV1g0xP3qAzOyjpf3zcp9vGutNGKSNxvoG9Me:cg/tW7VhvUuSEB3YTeutNG1xQG9H
TLSH	T1FEA6336FA5C377EFE56378EC42FF72D57802B1206E68BB6950A428584B1E9050B7370B
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	9'663'940 bytes
File size (de-compressed) :	26'295'320 bytes
Format:	linux/amd64
Unpacked file:	6462b9c8fd8416413c866491a348b8fe503c10a75b3a3c25cb40da00f4e5e0aa

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0c0b6129-2bed-49d1-81be-a0a060c2aa62/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Receives data from a server

Collects information on the RAM

Changes access rights for a written file

Opens a port

Launching a process

Sends data to a server

Locks files

Creating a process from a recently created file

Creating a file

Deletes a file

Changes the time when the file was created, accessed, or modified

Collects information on the CPU

Connection attempt

Creates or modifies files in /cron to set up autorun

Gathering data

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Adware

File Type:

elf.64.le

First seen:

2026-04-25T04:16:00Z UTC

Last seen:

2026-04-25T06:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3ebff4aa-9f44-419e-8667-041b3caaa644

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a9a54519-17b6-40b8-9eaf-328a4f176090

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7fec8d6208f05fc36672c3365a6008d5153e4187c747f9b8a8d56b3f9291bf7/

Threat name:

Linux.Adware.Generic

Status:

Suspicious

First seen:

2026-04-25 07:14:57 UTC

File Type:

ELF64 Little (Exe)

AV detection:

11 of 38 (28.95%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=477mrvrar4c7ynthfqzwljqarvivhzaypr2h7g4krvllh6jjdp3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery linux upx

Link:

https://tria.ge/reports/260425-se96ksdy3m/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

UPX packed file

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/