MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677
SHA3-384 hash: 64bd08b66f8147cc3436527ff5a2d3de4ba3244dd632ad8d7be0064da65f8da3578994fbe9a6d184331a46b37ca4d60e
SHA1 hash: 425bfa6557dd64928a3510dba91ca3cfc03323b3
MD5 hash: 2ef172212f729de3580d8f5a9887a97a
humanhash: virginia-tennessee-texas-nuts
File name:xnxnxnxnxnxnxnxnx86_64xnxn
Download: download sample
Signature Mirai
Create hunting rule
File size:63'920 bytes
First seen:2026-08-23 03:03:01 UTC
Last seen:2026-08-23 15:24:55 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:PV62D7aC5rE/7RheOslefeFOQrJS/od7E/sI1aNkfhAQG:fj6WlyeFfrsIFIwtQG
TLSH T1B95302F2461CDA12DE8AC53AA3ACB641878D3EC54BAD9427B478DC8C9114D04BE67E13
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt UPX
File size (compressed) :63'920 bytes
File size (de-compressed) :136'064 bytes
Format:linux/amd64
Unpacked file: a4a299da6d732b74aae51e68c35f81fcc85b701afaf785dcbc7d72f5d26fdc0c

Intelligence

File Origin
# of uploads :
3
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5b822cb1-4f83-4768-b242-73a4625404b1/
Detection(s):
SecuriteInfo.com.Trojan.Linux.Gafgyt.5355.11181.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Kills processes
Receives data from a server
Locks files
Connection attempt
Sends data to a server
Runs as daemon
Creating a file in the %temp% directory
DNS request
Creating a file
Substitutes an application name
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
bashlite packed packer upx
Link:
https://www.filescan.io/uploads/6a8a62f593dd4ae9d825fead/reports/59e44ed7-2f52-4e5f-8bd0-b562545794de/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/995ac72c-de18-4cfe-8f75-2d2360788581
Behavior Graph:
Download SVG
%3 guuid=2169d3fa-1d00-0000-7211-f6878c090000 pid=2444 /usr/bin/sudo guuid=a47590fe-1d00-0000-7211-f6878f090000 pid=2447 /tmp/sample.bin write-file guuid=2169d3fa-1d00-0000-7211-f6878c090000 pid=2444->guuid=a47590fe-1d00-0000-7211-f6878f090000 pid=2447 execve guuid=dea46900-1e00-0000-7211-f68792090000 pid=2450 /tmp/sample.bin zombie guuid=a47590fe-1d00-0000-7211-f6878f090000 pid=2447->guuid=dea46900-1e00-0000-7211-f68792090000 pid=2450 clone guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451 /tmp/sample.bin net send-data zombie guuid=dea46900-1e00-0000-7211-f68792090000 pid=2450->guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451 clone 78f1e8cf-da0a-58bd-8c51-441e4da4f218 176.65.139.131:54128 guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451->78f1e8cf-da0a-58bd-8c51-441e4da4f218 send: 18B 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 40B guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2452 /tmp/sample.bin guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451->guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2452 clone guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2453 /tmp/sample.bin zombie guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2451->guuid=38bc8e00-1e00-0000-7211-f68793090000 pid=2453 clone
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7afae29-d1c0-48aa-ada1-4d9e032102d8
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1962330
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2026-08-23 03:03:36 UTC
File Type:
ELF64 Little (Exe)
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a32gmpxzchsvpenfqjr7bqo74cws7nlsd6ylvdos27g3lt6duz3q._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
antivm discovery linux upx
Link:
https://tria.ge/reports/260823-dj6avssclf/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Reads system network configuration
Checks hardware identifiers (DMI)
Enumerates active TCP sockets
Enumerates running processes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 06f4663ef911e55791a58263f0c1dfe0ad2fb5721fb0ba8dd2d7cdb5cfc3a677

(this sample)

Mirai

elf a4a299da6d732b74aae51e68c35f81fcc85b701afaf785dcbc7d72f5d26fdc0c

  
URLhaus
https://urlhaus.abuse.ch/url/3858170/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 a4a299da6d732b74aae51e68c35f81fcc85b701afaf785dcbc7d72f5d26fdc0c
  
Dropping
MD5 fdc7f813f3bac38fa976da7a9c813bf4

Comments