MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f
SHA3-384 hash:	48d811ae4a1f05bcea5270903a685dcee20f4713d485341af987402521c50cfc4a6dc228e02ce422ae2dc2303e0e5829
SHA1 hash:	661a0e51376446bc11b01f7c8e50d8c4ad5e49aa
MD5 hash:	f3dae8e1dacf70c24ec61a2767ab2099
humanhash:	may-mountain-item-spring
File name:	niggah.ppc
Download:	download sample
File size:	50'652 bytes
First seen:	2025-11-29 05:14:19 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:zKelPHJI7SAoWXOGwRCy9L/TYAGjpWvDfnmux+FF8tVGiEoIw:OsPpDW+qsLbYjw7fm+y8/1Eoz
TLSH	T169333B41B31C0543C5B36EB03A3B2BD0E3ABAAD122A4E385751FE68DD0B5D369546ECD
Magika	elf
Reporter	abuse_ch
Tags:	elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 98084a37b8b8830dc07c2bdb0edfee5030af4e94bc776359d2632bf884acdc7e

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	25'512 bytes
File size (de-compressed) :	50'652 bytes
Format:	linux/ppc32
Packed file:	98084a37b8b8830dc07c2bdb0edfee5030af4e94bc776359d2632bf884acdc7e

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Mirai-9940367-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Deleting a recently created file

Sends data to a server

Kills processes

Creating a file in the %temp% directory

Locks files

Runs as daemon

Opens a port

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/692a8173d0d5e7288b502776/reports/89d27560-d4bc-40ab-8872-2f224562ce5c/overview

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/45b90378-eee1-47db-880b-199bf505309a

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c203cd4d-d5d8-432c-a321-d4d9e397124f

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1822711

Signature

Antivirus / Scanner detection for submitted sample

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62yqpv6qnao3k36xl5dswq7examq5rj27ar2p7cflspcvwacvihq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251129-fxsb9sej6w/

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-9940367-0

YARA:

n/a

Link:

https://app.threat.zone/submission/1bad9f91-181a-46b2-b81b-d5e0dea17710

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f6b107d7d0681db56fd75f472b43e4b8190ec53af823a7fc455c9e2ad802aa0f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.