SUSPICIOUS — 00b737ebaf75e5059a7bfecc8f67d8269c82f9782bae8367f79740bbc1f23d97.elf

Verdict: suspicious (61/100) · Family: unknown

File type: elf · SHA-256: 00b737ebaf75e5059a7bfecc8f67d8269c82f9782bae8367f79740bbc1f23d97

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

MITRE ATT&CK

YARA

Dynamic analysis (linux)

1307 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• _http._tcp.archive.ubuntu.com
• archive.ubuntu.com
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• archive.ubuntu.com/ubuntu/pool/universe/s/sshpass/sshpass_1.09-1_amd64.deb
• 91.189.92.24:80
• 92.20.209.224:22
• 69.226.62.134:22
• 15.121.164.58:22
• 121.9.11.239:22
• 31.197.174.221:22
• 3.133.114.223:22
• 117.136.203.236:22
• 113.165.144.222:22
• 120.177.162.222:22
• 95.141.59.11:22
• 20.241.222.220:22
• 38.209.188.221:22
• 85.101.84.224:22
• 80.154.145.93:22

Analyzed on MalwareAnalyzer by Cyble · Open interactive report