28978ae6d797eb43770c8bb173235427ed0a548560725de03c06c080420f80e4
ELF
Verdict: SUSPICIOUS
AI
Packed ELF with IRC C2 strings
Local reference
Suspicious dependency
Inferred
Packed ELF retains mangled IRC JOIN and PRIVMSG: pty10:0x0
| 0x0 |
7f454c46010101030000000000000000 |
.ELF............Packed ELF binary |
| 0x10 |
0200280001000000e8ae0c0034000000 |
..(.........4...ARM machine field in ELF header |
| 0x20 |
00000000020000053400200002002800 |
........4. ...(. |
| 0x30 |
00000000010000000000000000800000 |
................ |
| 0x40 |
00800000e7370c00e7370c0005000000 |
.....7...7...... |
| 0x50 |
0080000001000000e8050000e8851b00 |
................ |
| 0x60 |
e8851b00000000000000000006000000 |
................ |
| 0x70 |
0080000036f46c860a00000018090d17 |
....6.l......... |
| 0x80 |
0000000048351a0048351a00f4000000 |
....H5..H5...... |
| 0x90 |
7c00000009000000f97f454c4601a400 |
|.........ELF... |
| 0xa0 |
1f02002800761bd882d706340eefe830 |
...(.v.....4...0 |
| 0xb0 |
1a2600b705162000067e361c001bef3f |
.&.... ..~6....? |
| 0xc0 |
7050e819f70050681a07f2d80800f204 |
pP....Ph........ |
| 0xd0 |
002c9b768007792cf119760527f20100 |
.,.v..y,..v.'... |
| 0xe0 |
0d1afb07003e047dbc94000006b73f87 |
.....>.}......?. |
| 0xf0 |
5df407802344910061bfb1077f77141e |
]...#D..a....w.. |
| 0x100 |
b5303ffd51e5746400ab01b6063f1249 |
.0?.Q.td.....?.I |
| 0x9fbe6 |
60064ec407ba581f430be0434b700e18 |
`.N...X.C..CKp.. |
| 0x9fbf6 |
f95b1770370c70fb17411ca7a13b272b |
.[.p7.p..A...;'+ |
| 0x9fc06 |
4f6c5a23733b8800a3c109fb570a9e6d |
OlZ#s;......W..m |
| 0x9fc16 |
485317f0203e3e47f720b53219bb4644 |
HS.. >>G. .2..FD |
| 0x9fc26 |
636578d07520c0056088f15d433b18a3 |
cex.u ..`..]C;.. |
| 0x9fc36 |
1a7289df73ed01fb4d4f4423f92d7869 |
.r..s...MOD#.-xi |
| 0x9fc46 |
7e4a4f494ec043fb383937340fb85748 |
~JOIN.C.8974..WHPacked ELF retains mangled IRC JOIN and PRIVMSG |
| 0x9fc56 |
4f863705cc4edb472037fe3337360034 |
O.7..N.G 7.376.4 |
| 0x9fc66 |
3333db0632322e7e5249564d5347cd0e |
33..22.~RIVMSG.. |
| 0x9fc76 |
7c4777373f97480e351c6fe0637256d4 |
|Gw7?.H.5.o.crV. |
| 0x9fc86 |
6162f01f5b592702d8152b0672175824 |
ab..[Y'...+.r.X$ |
| 0x9fc96 |
fe5054670a4c700c19df132d7620c622 |
.PTg.Lp....-v ." |
| 0x9fca6 |
6e36ba44a322935a2859f43b207edb22 |
n6.D.".Z(Y.; ~." |
| 0x9fcb6 |
2a20c2031d9b20203f2631202622f629 |
* .... ?&1 &".) |
| 0x9fcc6 |
207c206d37f7271b26bc4c180b246974 |
| m7.'.&.L..$it |
| 0x9fcd6 |
7329d75b827622203e3b0f320067cb30 |
s).[.v" >;.2.g.0 |
| 0x9fce6 |
3af8323334353a4d2070f761776e3a51 |
:.2345:M p.awn:Q |
| 0x9fcf6 |
b4532db74d328b9b06f7c1726decda66 |
.S-.M2.....rm..f |
| 0x9fd06 |
753a006b3875d22b62f0636d7220fd5f |
u:.k8u.+b.cmr ._ |
| 0x9fd16 |
6c73a3777f1f72632e17e56b1f1aaf4c |
ls.w..rc...k...L |
| 0x9fd26 |
663f70066088c53a5c41611f81acc366 |
f?p.`..:\Aa....f |
| 0x9fd36 |
2f9026417e8dd7ad45 |
/.&A~...E |
Objectives
| 0x0 |
7f454c46010101030000000000000000 |
.ELF............ |
| 0x10 |
0200280001000000e8ae0c0034000000 |
..(.........4... |
| 0x20 |
00000000020000053400200002002800 |
........4. ...(. |
| 0x30 |
00000000010000000000000000800000 |
................ |
| 0x40 |
00800000e7370c00e7370c0005000000 |
.....7...7...... |
| 0x50 |
0080000001000000e8050000e8851b00 |
................ |
| 0x60 |
e8851b00000000000000000006000000 |
................ |
| 0x70 |
0080000036f46c860a00000018090d17 |
....6.l......... |
| 0x80 |
0000000048351a0048351a00f4000000 |
....H5..H5...... |
| 0x90 |
7c00000009000000f97f454c4601a400 |
|.........ELF... |
| 0xa0 |
1f02002800761bd882d706340eefe830 |
...(.v.....4...0 |
| 0xb0 |
1a2600b705162000067e361c001bef3f |
.&.... ..~6....? |
| 0xc0 |
7050e819f70050681a07f2d80800f204 |
pP....Ph........ |
| 0xd0 |
002c9b768007792cf119760527f20100 |
.,.v..y,..v.'... |
| 0xe0 |
0d1afb07003e047dbc94000006b73f87 |
.....>.}......?. |
| 0xf0 |
5df407802344910061bfb1077f77141e |
]...#D..a....w.. |
| 0x100 |
b5303ffd51e5746400ab01b6063f1249 |
.0?.Q.td.....?.I |
| 0x9fbe6 |
60064ec407ba581f430be0434b700e18 |
`.N...X.C..CKp.. |
| 0x9fbf6 |
f95b1770370c70fb17411ca7a13b272b |
.[.p7.p..A...;'+ |
| 0x9fc06 |
4f6c5a23733b8800a3c109fb570a9e6d |
OlZ#s;......W..m |
| 0x9fc16 |
485317f0203e3e47f720b53219bb4644 |
HS.. >>G. .2..FD |
| 0x9fc26 |
636578d07520c0056088f15d433b18a3 |
cex.u ..`..]C;.. |
| 0x9fc36 |
1a7289df73ed01fb4d4f4423f92d7869 |
.r..s...MOD#.-xi |
| 0x9fc46 |
7e4a4f494ec043fb383937340fb85748 |
~JOIN.C.8974..WH |
| 0x9fc56 |
4f863705cc4edb472037fe3337360034 |
O.7..N.G 7.376.4 |
| 0x9fc66 |
3333db0632322e7e5249564d5347cd0e |
33..22.~RIVMSG.. |
| 0x9fc76 |
7c4777373f97480e351c6fe0637256d4 |
|Gw7?.H.5.o.crV. |
| 0x9fc86 |
6162f01f5b592702d8152b0672175824 |
ab..[Y'...+.r.X$ |
| 0x9fc96 |
fe5054670a4c700c19df132d7620c622 |
.PTg.Lp....-v ." |
| 0x9fca6 |
6e36ba44a322935a2859f43b207edb22 |
n6.D.".Z(Y.; ~." |
| 0x9fcb6 |
2a20c2031d9b20203f2631202622f629 |
* .... ?&1 &".) |
| 0x9fcc6 |
207c206d37f7271b26bc4c180b246974 |
| m7.'.&.L..$it |
| 0x9fcd6 |
7329d75b827622203e3b0f320067cb30 |
s).[.v" >;.2.g.0 |
| 0x9fce6 |
3af8323334353a4d2070f761776e3a51 |
:.2345:M p.awn:Q |
| 0x9fcf6 |
b4532db74d328b9b06f7c1726decda66 |
.S-.M2.....rm..f |
| 0x9fd06 |
753a006b3875d22b62f0636d7220fd5f |
u:.k8u.+b.cmr ._ |
| 0x9fd16 |
6c73a3777f1f72632e17e56b1f1aaf4c |
ls.w..rc...k...L |
| 0x9fd26 |
663f70066088c53a5c41611f81acc366 |
f?p.`..:\Aa....f |
| 0x9fd36 |
2f9026417e8dd7ad45 |
/.&A~...E |
| 0x0 |
7f454c46010101030000000000000000 |
.ELF............ |
| 0x10 |
0200280001000000e8ae0c0034000000 |
..(.........4... |
| 0x20 |
00000000020000053400200002002800 |
........4. ...(. |
| 0x30 |
00000000010000000000000000800000 |
................ |
| 0x40 |
00800000e7370c00e7370c0005000000 |
.....7...7...... |
| 0x50 |
0080000001000000e8050000e8851b00 |
................ |
| 0x60 |
e8851b00000000000000000006000000 |
................ |
| 0x70 |
0080000036f46c860a00000018090d17 |
....6.l......... |
| 0x80 |
0000000048351a0048351a00f4000000 |
....H5..H5...... |
| 0x90 |
7c00000009000000f97f454c4601a400 |
|.........ELF... |
| 0xa0 |
1f02002800761bd882d706340eefe830 |
...(.v.....4...0 |
| 0xb0 |
1a2600b705162000067e361c001bef3f |
.&.... ..~6....? |
| 0xc0 |
7050e819f70050681a07f2d80800f204 |
pP....Ph........ |
| 0xd0 |
002c9b768007792cf119760527f20100 |
.,.v..y,..v.'... |
| 0xe0 |
0d1afb07003e047dbc94000006b73f87 |
.....>.}......?. |
| 0xf0 |
5df407802344910061bfb1077f77141e |
]...#D..a....w.. |
| 0x100 |
b5303ffd51e5746400ab01b6063f1249 |
.0?.Q.td.....?.I |
Metadata
| 0x0 |
7f454c46010101030000000000000000 |
.ELF............ |
| 0x10 |
0200280001000000e8ae0c0034000000 |
..(.........4... |
| 0x20 |
00000000020000053400200002002800 |
........4. ...(. |
| 0x30 |
00000000010000000000000000800000 |
................ |
| 0x40 |
00800000e7370c00e7370c0005000000 |
.....7...7...... |
| 0x50 |
0080000001000000e8050000e8851b00 |
................ |
| 0x60 |
e8851b00000000000000000006000000 |
................ |
| 0x70 |
0080000036f46c860a00000018090d17 |
....6.l......... |
| 0x80 |
0000000048351a0048351a00f4000000 |
....H5..H5...... |
| 0x90 |
7c00000009000000f97f454c4601a400 |
|.........ELF... |
| 0xa0 |
1f02002800761bd882d706340eefe830 |
...(.v.....4...0 |
| 0xb0 |
1a2600b705162000067e361c001bef3f |
.&.... ..~6....? |
| 0xc0 |
7050e819f70050681a07f2d80800f204 |
pP....Ph........ |
| 0xd0 |
002c9b768007792cf119760527f20100 |
.,.v..y,..v.'... |
| 0xe0 |
0d1afb07003e047dbc94000006b73f87 |
.....>.}......?. |
| 0xf0 |
5df407802344910061bfb1077f77141e |
]...#D..a....w.. |
| 0x100 |
b5303ffd51e5746400ab01b6063f1249 |
.0?.Q.td.....?.I |
-
0x0
7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 e8 ae 0c 00 34 00 00 00 00 00 00 00 02 00 00 05 34 00 20 00 02 00 28 00 00 00 00 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 e7 37 0c 00 e7 37 0c 00 05 00 00 00 00 80 00 00 01 00 00 00 e8 05 00 00 e8 85 1b 00 e8 85 1b 00 00 00 00 00 00 00 00 00 06 00 00 00 00 80 00 00 36 f4 6c 86 0a 00 00 00 18 09 0d 17 00 00 00 00 48 35 1a 00 48 35 1a 00 f4 00 00 00 7c 00 00 00 09 00 00 00 f9 7f 45 4c 46 01 a4 00 1f 02 00 28 00 76 1b d8 82 d7 06 34 0e ef e8 30 1a 26 00 b7 05 16 20 00 06 7e 36 1c 00 1b ef 3f 70 50 e8 19 f7 00 50 68 1a 07 f2 d8 08 00 f2 04 00 2c 9b 76 80 07 79 2c f1 19 76 05 27 f2 01 00 0d 1a fb 07 00 3e 04 7d bc 94 00 00 06 b7 3f 87 5d f4 07 80 23 44 91 00 61 bf b1 07 7f 77 14 1e b5 30 3f fd 51 e5 74 64 00 ab 01 b6 06 3f 12 49 .ELF..............(.........4...........4. ...(......................7...7..........................................6.l.............H5..H5......|.........ELF......(.v.....4...0.&.... ..~6....?pP....Ph.........,.v..y,..v.'........>.}......?.]...#D..a....w...0?.Q.td.....?.I
×3
-
0x0
7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 e8 ae 0c 00 34 00 00 00 00 00 00 00 02 00 00 05 34 00 20 00 02 00 28 00 00 00 00 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 e7 37 0c 00 e7 37 0c 00 05 00 00 00 00 80 00 00 01 00 00 00 e8 05 00 00 e8 85 1b 00 e8 85 1b 00 00 00 00 00 00 00 00 00 06 00 00 00 00 80 00 00 36 f4 6c 86 0a 00 00 00 18 09 0d 17 00 00 00 00 48 35 1a 00 48 35 1a 00 f4 00 00 00 7c 00 00 00 09 00 00 00 f9 7f 45 4c 46 01 a4 00 1f 02 00 28 00 76 1b d8 82 d7 06 34 0e ef e8 30 1a 26 00 b7 05 16 20 00 06 7e 36 1c 00 1b ef 3f 70 50 e8 19 f7 00 50 68 1a 07 f2 d8 08 00 f2 04 00 2c 9b 76 80 07 79 2c f1 19 76 05 27 f2 01 00 0d 1a fb 07 00 3e 04 7d bc 94 00 00 06 b7 3f 87 5d f4 07 80 23 44 91 00 61 bf b1 07 7f 77 14 1e b5 30 3f fd 51 e5 74 64 00 ab 01 b6 06 3f 12 49 .ELF..............(.........4...........4. ...(......................7...7..........................................6.l.............H5..H5......|.........ELF......(.v.....4...0.&.... ..~6....?pP....Ph.........,.v..y,..v.'........>.}......?.]...#D..a....w...0?.Q.td.....?.I
×2
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
-
0x0
7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 e8 ae 0c 00 34 00 00 00 00 00 00 00 02 00 00 05 34 00 20 00 02 00 28 00 00 00 00 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 e7 37 0c 00 e7 37 0c 00 05 00 00 00 00 80 00 00 01 00 00 00 e8 05 00 00 e8 85 1b 00 e8 85 1b 00 00 00 00 00 00 00 00 00 06 00 00 00 00 80 00 00 36 f4 6c 86 0a 00 00 00 18 09 0d 17 00 00 00 00 48 35 1a 00 48 35 1a 00 f4 00 00 00 7c 00 00 00 09 00 00 00 f9 7f 45 4c 46 01 a4 00 1f 02 00 28 00 76 1b d8 82 d7 06 34 0e ef e8 30 1a 26 00 b7 05 16 20 00 06 7e 36 1c 00 1b ef 3f 70 50 e8 19 f7 00 50 68 1a 07 f2 d8 08 00 f2 04 00 2c 9b 76 80 07 79 2c f1 19 76 05 27 f2 01 00 0d 1a fb 07 00 3e 04 7d bc 94 00 00 06 b7 3f 87 5d f4 07 80 23 44 91 00 61 bf b1 07 7f 77 14 1e b5 30 3f fd 51 e5 74 64 00 ab 01 b6 06 3f 12 49 .ELF..............(.........4...........4. ...(......................7...7..........................................6.l.............H5..H5......|.........ELF......(.v.....4...0.&.... ..~6....?pP....Ph.........,.v..y,..v.'........>.}......?.]...#D..a....w...0?.Q.td.....?.I
-
0x0
7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 02 00 28 00 01 00 00 00 e8 ae 0c 00 34 00 00 00 00 00 00 00 02 00 00 05 34 00 20 00 02 00 28 00 00 00 00 00 01 00 00 00 00 00 00 00 00 80 00 00 00 80 00 00 e7 37 0c 00 e7 37 0c 00 05 00 00 00 00 80 00 00 01 00 00 00 e8 05 00 00 e8 85 1b 00 e8 85 1b 00 00 00 00 00 00 00 00 00 06 00 00 00 00 80 00 00 36 f4 6c 86 0a 00 00 00 18 09 0d 17 00 00 00 00 48 35 1a 00 48 35 1a 00 f4 00 00 00 7c 00 00 00 09 00 00 00 f9 7f 45 4c 46 01 a4 00 1f 02 00 28 00 76 1b d8 82 d7 06 34 0e ef e8 30 1a 26 00 b7 05 16 20 00 06 7e 36 1c 00 1b ef 3f 70 50 e8 19 f7 00 50 68 1a 07 f2 d8 08 00 f2 04 00 2c 9b 76 80 07 79 2c f1 19 76 05 27 f2 01 00 0d 1a fb 07 00 3e 04 7d bc 94 00 00 06 b7 3f 87 5d f4 07 80 23 44 91 00 61 bf b1 07 7f 77 14 1e b5 30 3f fd 51 e5 74 64 00 ab 01 b6 06 3f 12 49 .ELF..............(.........4...........4. ...(......................7...7..........................................6.l.............H5..H5......|.........ELF......(.v.....4...0.&.... ..~6....?pP....Ph.........,.v..y,..v.'........>.}......?.]...#D..a....w...0?.Q.td.....?.I
Identity
| SHA-256 |
28978ae6d797eb43770c8bb173235427ed0a548560725de03c06c080420f80e4 |
| Filename |
pty10 |
| Package |
28978ae6d797eb43770c8bb173235427ed0a548560725de03c06c080420f80e4 |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Ecosystem |
linux |
| Domain |
abuse.ch |
Timeline
| First seen |
11 Aug 2026 07:32 UTC |
| First analyzed |
12 Aug 2026 17:22 UTC |
| Last analyzed |
12 Aug 2026 17:22 UTC |
| Last updated |
12 Aug 2026 17:22 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
73866 |