MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0699da5b5039904173deb6327c38291b0ce9f56cb0db9bb30ce8815304c8b241. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0699da5b5039904173deb6327c38291b0ce9f56cb0db9bb30ce8815304c8b241
SHA3-384 hash:	93b6d49e7294233d8f5f9513497e1c0fa25f900cbde4c97e8437f3c3aa45ece5597530d83228d97a125c7c9f8c4b7cd3
SHA1 hash:	d46f51d292b84273c9edbdf1399069f7798d7a22
MD5 hash:	d6a05da36a2c8fc1d1a7fb9a0166f1f6
humanhash:	oranges-hotel-enemy-arkansas
File name:	lol.armv5l
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	107'272 bytes
First seen:	2025-04-17 10:00:02 UTC
Last seen:	2025-04-17 11:18:56 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:K/nOXtSG38AMzAzvldwrPvGIBp+0nsq+coA5zp5JXrDrnClVjJgOMj/E7kFAOhEE:Lt0AMzAErPvGIBp9nsqUOp5xKJgLzTR
TLSH	T146A31B8DE861AB26C1E965BEFE6D05CD330217BCD2EA31158D065F21678E84D0E3EBC5
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.ELF.Mirai-CQU.20210.31316.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800d75f280f5f89a0d05b98linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Sends data to a server

Opens a port

Creating a file

Receives data from a server

Substitutes an application name

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6800d15e931404048d7fe604/reports/c1e30fb9-9fa6-4cf4-9441-81ea3b554d3c/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

1

Number of processes launched:

1

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/0699da5b5039904173deb6327c38291b0ce9f56cb0db9bb30ce8815304c8b241

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 74.125.250.129:19302

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/77143c87-dbd8-414c-ba97-df08f7666d42

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1667365

Signature

Performs DNS TXT record lookups

Suricata IDS alerts for network traffic

Uses STUN server to do NAT traversial

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/0699da5b5039904173deb6327c38291b0ce9f56cb0db9bb30ce8815304c8b241

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0699da5b5039904173deb6327c38291b0ce9f56cb0db9bb30ce8815304c8b241/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-17 10:00:57 UTC

File Type:

ELF32 Little (Exe)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a2m5uw2qhgiec466wyzhyobjdmgot5lmwdnzxmym5cavgbgiwjaq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/250417-l1zhms1xds/

Behaviour

Changes its process name

Renames itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.