MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d
SHA3-384 hash: 18045ca6bb3f93047ae864d5d749ab422c8efdf426c8454b18907f9f65a25ded8f27814394459e914b77ab9e914848d5
SHA1 hash: 37b53fe95b665d98f996fc6b6f64ea8c470345e6
MD5 hash: d1a6d16d282cb11c3ca299f20f6ff202
humanhash: kilo-sweet-london-pennsylvania
File name:mips.uhavenobotsxd
Download: download sample
Signature Mirai
Create hunting rule
File size:119'684 bytes
First seen:2025-11-09 07:11:48 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:i+pzPnr8LWSoGHiXewtXap1hoOLW2iCXXO/:9nr8CSMXedj9i5/
TLSH T181C3D85D2E328FBDF768863447B38F21975C239227E0D585E2ACD5055F7028D682FBA4
telfhash t1b221925c497423f497325c8a2aaeff7be15030de1b267d378e05a9bd66bd8815d00c1c
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-10001386-0
Create hunting rule

Unix.Trojan.Mirai-10010127-0
Create hunting rule

Unix.Trojan.Mirai-10017351-0
Create hunting rule

Unix.Trojan.Mirai-10017641-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Deleting a recently created file
Mounts file systems
Creates directories in a temporary directory
Runs as daemon
Creating a file in the %temp% directory
Sets a written file as executable
Receives data from a server
Kills processes
Creating a file
Opens a port
Creating a file in the %temp% subdirectories
Sends data to a server
Substitutes an application name
Gathering data
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
true
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
6
Number of processes launched:
147
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d
Behaviour
Anti-VM
Process Renaming
Botnet C2s
TCP botnet C2(s):
type:Mirai 94.154.35.153:6969
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-11-08T23:27:00Z UTC
Last seen:
2025-11-09T04:45:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Gafgyt.gu HEUR:Backdoor.Linux.Mirai.b
Link:
https://opentip.kaspersky.com/0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d3c48579-f3d6-4601-9749-d985bd1d8a99
Behavior Graph:
Download SVG
%3 guuid=72687496-1700-0000-8828-04c8af090000 pid=2479 /usr/bin/sudo guuid=6113c398-1700-0000-8828-04c8b1090000 pid=2481 /tmp/sample.bin guuid=72687496-1700-0000-8828-04c8af090000 pid=2479->guuid=6113c398-1700-0000-8828-04c8b1090000 pid=2481 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cdf08f17-ced4-4f00-9ee8-423e1a8696ce
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1810857
Signature
Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1810857 Sample: mips.uhavenobotsxd.elf Startdate: 09/11/2025 Architecture: LINUX Score: 52 28 Multi AV Scanner detection for submitted file 2->28 8 mips.uhavenobotsxd.elf 2->8         started        11 udisksd dumpe2fs 2->11         started        13 udisksd dumpe2fs 2->13         started        15 159 other processes 2->15 process3 signatures4 30 Sample reads /proc/mounts (often used for finding a writable filesystem) 8->30 17 mips.uhavenobotsxd.elf 8->17         started        process5 file6 24 /tmp/.taunt, POSIX 17->24 dropped 26 /tmp/.mock, POSIX 17->26 dropped 20 mips.uhavenobotsxd.elf 17->20         started        process7 process8 22 mips.uhavenobotsxd.elf 20->22         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-11-09 04:41:36 UTC
File Type:
ELF32 Big (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anm56un6raq3f6rcnpsslhy6ew547lkpnl3yn4mw6jvxyqkvurwq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai discovery
Link:
https://tria.ge/reports/251109-h1l1rssnap/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
Reads runtime system information
Changes its process name
Security Software Discovery
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-10001386-0
YARA:
n/a
Link:
https://app.threat.zone/submission/6f0dde7e-8e30-4955-91fc-f1fc64807754
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202503_elf_Mirai
Create hunting rule
Author:abuse.ch
Description:Detects Mirai 'TSource' ELF files
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 0359df51be8821b2fa226be5259f1e25bbcfad4f6af786f196f26b7c4155a46d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3686386/
  
Delivery method
Distributed via web download

Comments