MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35
SHA3-384 hash:	777199e1fb72fb414e3a177f4fd38f477e24bb2c8df85747b9610149b065113cbd6b612cb3fb7ce01b085772a1c811db
SHA1 hash:	bb542f94655253ab371f5432f6c3da88045ddc9f
MD5 hash:	a44764278a3166b0b482ad2cf2bc68c0
humanhash:	winter-one-table-yankee
File name:	sh4
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	42'676 bytes
First seen:	2026-02-27 02:00:22 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:RYXNhfPu+8r2FPDoLbxOME0ClBsoXYkrxCCo:RYXNh++loLbxPE0MokrxCCo
TLSH	T1B3138CB7C559ADD4C14947B5AA208E3823A3F90093671FFA5E8685A99007EFCF21D3F1
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

DE

Vendor Threat Intelligence

ACCE Mirai_Botnet_XOR_Lookup

Malware configuration found for:

Mirai

Details

Mirai

a c2 socket address and a scan socket address

Link:

https://research.acce.ciphertechsolutions.com/results/dd088b9e-0966-4d2c-81be-5c989d5ef80d/

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-7138377-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7540663-0

Alert

Create hunting rule

Unix.Trojan.Mirai-7674518-0

Alert

Create hunting rule

Unix.Trojan.Mirai-8025795-0

Alert

Create hunting rule

Unix.Trojan.Generic-9910199-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10057021-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69a0fac210e80629d4f48e86/reports/86eb1b32-014d-4755-9575-562280a69b9c/overview

InQuest

Result

Gathering data

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/9fa89b9b-ae36-4442-b761-e6b0c1b9b941

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-27 02:00:44 UTC

AV detection:

20 of 36 (55.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=amnx4ojydnzpsormqv3agky2onzwtonauqcij76nx6shtmplhq2q._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai linux

Link:

https://tria.ge/reports/260227-ce98ksfw5a/

Malware Config

C2 Extraction:

hoon.cyberium.cc

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/031b7e39381b72f93a2c8576032b1a737369b9a0a40484ffcdbfa479b1eb3c35