YARAify Scan Results

Task Information

---

Task ID:	6a15a9cd-b41a-11f1-a0cd-42010aa4000b
File name:	d3397f855bdea91e684190e63bd42404a8d13ff69a6c0cce32877b68a9b5afe6.elf
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	linux_generic_ipv6_catcher Alert Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses
TLP:	TLP:WHITE
Repository:	Stratosphere

Rule name:	Linux_Generic_Threat_3fa2df51 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	malware_SNOWLIGHT_ELF Alert Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	SNOWLIGHT
Reference:	https://sect.iij.ad.jp/blog/2025/11/unc5174-windows-snowlight-in-2025/
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	setsockopt Alert Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Alert Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	unixredflags3 Alert Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.