MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a
SHA3-384 hash:	a4abcf92c0773d1a8d7a21923b8267f0ea0073a021bf695160a6e41fd1e0f0f8048fc133ffce87aa355989c3bb28b49b
SHA1 hash:	25e333f78a61c4a53587bc0a72b826ddb13a3909
MD5 hash:	2f5df7e178b41eb27f4ef0230a52adaa
humanhash:	failed-snake-spring-hawaii
File name:	shabak.mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	176'088 bytes
First seen:	2026-04-26 19:43:03 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:CGb6ES9SaWqOFdyW7d6VAie2rK4zTTs/3R/CH6uT4MHCYNJ2rK4oHyWaH/uNkdYV:RFrdSspAaUVjn2y0WyqSkcnnY
TLSH	T1C404433E7E21BF7FE268863107F66FB0C75921D232E19241E17CD2185EB528D189EB64
telfhash	t1af31ae0c4d7823f097754c9d2aedef76e5a030df1b226d278e00e9ada6add825d00c1c
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Sanesecurity.Malware.29052.TSource.UNOFFICIAL

Unix.Dropper.Mirai-7138855-0

Unix.Trojan.Mirai-8041683-0

Unix.Trojan.Mirai-8041698-0

Unix.Trojan.Mirai-9943729-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates or modifies symbolic links

Connection attempt

Runs as daemon

Creating a file in the %temp% directory

Creating a file

Substitutes an application name

Gathering data

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2026-04-26T16:57:00Z UTC

Last seen:

2026-04-27T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ca63cac3-00a8-4dac-940c-256f1eb47b27

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/aac51e6b-fef2-4688-93fe-7e944e7d1171

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2026-04-26 19:43:48 UTC

File Type:

ELF32 Big (Exe)

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c2oek4ncgkqm7dsjdsas75bbno45xywnzdp34nxbhboe6uf6kuva._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/260426-yfj9fafw2s/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

Reads system routing table

Deletes Audit logs

Deletes system logs

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202503_elf_Mirai Create hunting rule
Author:	abuse.ch
Description:	Detects Mirai 'TSource' ELF files

Rule name:	botnet_dayzddos Create hunting rule
Author:	NDA0E
Description:	dayzddos botnet

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	gafgyt_ansi_beacon Create hunting rule
Author:	Liho
Description:	Detects Gafgyt variant with custom ANSI-colored IP beacon
Reference:	Custom bot variant using ANSI red in IP report string

Rule name:	Linux_Trojan_Gafgyt_28a2fe0c Create hunting rule
Author:	Elastic Security

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/