YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c.
Scan Results
| SHA256 hash: | ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c | |
|---|---|---|
| File size: | 203'746 bytes | |
| File download: | Original | |
| MIME type: | application/x-executable | |
| MD5 hash: | 10ca536e82aa923cd29eea3d79d2b017 | |
| SHA1 hash: | 47b00e2fcb9efe48427884620d6839476ee8ac41 | |
| SHA3-384 hash: | 4759d5528d03ca4d9fad20a1ea8a77a6e27ebb3f13d5a00c66b6979c9270090add300c12735c811c46732b0bffdaf0fa | |
| First seen: | 2026-04-02 15:55:01 UTC | |
| Last seen: | 2026-04-02 16:09:23 UTC | |
| Sightings: | 6 | |
| imphash : | n/a | |
| ssdeep : | 6144:CiDbm+KNe8W8ayGeVOKN387Aq+CHRPV/G7l:CQmXe8W8ayGeVOKpYtt/I | |
| TLSH : | n/a | |
| telfhash : | t1d2311061993812252a61ec18ec6957f3492787261750bb35ef36c8cc380f44af636c1f | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 6 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 50bdc87b-2eae-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c.elf | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
| Task ID: | de1a5f24-2eac-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | net-workd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
| Task ID: | ba6b35d1-2eac-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | net-workd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
| Task ID: | 96e799a6-2eac-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | net-workd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
| Task ID: | 73415b8f-2eac-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | net-workd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
| Task ID: | 4edf3d5d-2eac-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | net-workd | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | Unix.Dropper.Mirai-7135897-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135901-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135909-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135918-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135925-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7135954-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136016-0 |
|---|
| Signature: | Unix.Dropper.Mirai-7136028-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059006-0 |
|---|
| Signature: | Unix.Trojan.Mirai-10059216-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7100807-0 |
|---|
| Signature: | Unix.Trojan.Mirai-7135916-0 |
|---|
| Signature: | Unix.Trojan.Mirai-8025795-0 |
|---|
| Signature: | Unix.Trojan.Mirai-9760303-0 |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | ELF_Toriilike_persist |
|---|---|
| Author: | 4r4 |
| Description: | Detects Torii IoT Botnet (stealthier Mirai alternative) |
| Reference: | Identified via researched data |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | enterpriseapps2 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Enterprise apps |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | classified |
|---|---|
| TLP : | TLP:AMBER |
| Rule name: | setsockopt |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for setsockopt() red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Linux malware mass-hunt rule - 2026 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.