YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63.
Scan Results
| SHA256 hash: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
|---|---|---|
| File size: | 479'088 bytes | |
| File download: | Original | |
| MIME type: | application/x-executable | |
| MD5 hash: | 64c7c05604c9fc34501d363c7d9189c8 | |
| SHA1 hash: | 64c6db630c747de5748b7030803d20aa6b446caa | |
| SHA3-384 hash: | 91eadde0e6cfa2c7548a3f0c0ede2ff54a317146e9d91f3d0e4c1acf1a73a29cc5e2379fd8c171a3a8788b0b04ee90cc | |
| First seen: | 2026-08-30 08:59:04 UTC | |
| Last seen: | 2026-08-30 09:03:03 UTC | |
| Sightings: | 6 | |
| imphash : | n/a | |
| ssdeep : | 6144:+vwgPYYlrFJtBqvFppipUn/xNiP9dlyoQoUChjd9/YwTAia9edw:+v7PplhkVi0qXUCh70ia9edw | |
| TLSH : | n/a | |
| telfhash : | t18281a73428b5791875ebc5167382e6e94d3158dc07e936b11b2fa859dfcbfc00cb28a2 | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 6 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 9b70ffef-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 77e86994-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 5e3e84aa-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63.elf | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | 53f68fb0-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 308658ad-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 0d1d0e69-a451-11f1-9de5-42010aa4000b | |
|---|---|---|
| File name: | 6ed6eab02be05bce37edd377176fd1ca02c7e3ecf3b6222f74ae034d390ecf63 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Sanesecurity.Malware.30435.LC.UNOFFICIAL |
|---|
| Signature: | Unix.Dropper.Mirai-7540662-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | ELF_IoT_Persistence_Hunt |
|---|---|
| Author: | 4r4 |
| Description: | Hunts for ELF files with persistence and download capabilities |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:GREEN |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | EXPL_HKTL_LNX_DirtyFragShellcode_May26 |
|---|---|
| Author: | Pezier Pierre-Henri (Nextron Systems) |
| Description: | Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux. |
| Reference: | https://github.com/V4bel/dirtyfrag/tree/master |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | linux_generic_ipv6_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | ELF samples using IPv6 addresses |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | linux_generic_irc_catcher |
|---|---|
| Author: | @_lubiedo |
| Description: | Find new ELF IRC samples |
| TLP: | TLP:WHITE |
| Repository: | Stratosphere |
| Rule name: | Linux_Trojan_Gafgyt_0cd591cd |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_33b4111a |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_620087b9 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_807911a2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_9e9530a7 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_a33a8363 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d0c57a2e |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d4227dbf |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Gafgyt_d996d335 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | Linux_Trojan_Mirai_e0cf29e2 |
|---|---|
| Author: | Elastic Security |
| TLP: | TLP:WHITE |
| Repository: | elastic |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found