SUSPICIOUS — 2ffbc8a866d557a4c5bc38138385f53f76495fdfc2e816c3c03a136fd4766132.elf

SUSPICIOUS — 2ffbc8a866d557a4c5bc38138385f53f76495fdfc2e816c3c03a136fd4766132.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100), attributed to the Modified family. 5 of 56 detection engines flagged it.

Identification

• SHA-256: 2ffbc8a866d557a4c5bc38138385f53f76495fdfc2e816c3c03a136fd4766132
• SHA-1: 80c83732233e3cf9a68e61b3ed41d17ccb4f7572
• MD5: b4eb81e7d911e9c08dea7d16ba35d997
• ssdeep: 1536:xjsyC2yFBgrpbucuWSpTuXS6qf9MXM+XjciN6iLQ:xjfFT8EqfSMZY5LQ
• TLSH: T1F1350255B3BDA8DBD130095ACD71752E1386113E680383FC82A446AA6E28BDF96F42C5
• Submitted as: 2ffbc8a866d557a4c5bc38138385f53f76495fdfc2e816c3c03a136fd4766132.elf
• File type: elf · Size: 60068 bytes
• Verdict: suspicious (61/100) · Family: Modified

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: Intezer community: INTEZER_ELF_UPX_Modified
• Detect It Easy (packer/type): DIE:UPX 3.94
• Microsoft Defender: Trojan:Win32/Leonem!rfn
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.h

Why this verdict

The suspicious score of 61/100 is the fusion of 4 weighted signals:

• YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule INTEZER_ELF_UPX_Modified) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX 3.94 (rule DIE:UPX 3.94) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://upx.sf.net - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob, UPX 3.94 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

This sample is built for ARM, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

Embedded URLs

• http://upx.sf.net

Embedded domains

• upx.sf.net

More Modified samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report