MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0930ef784776826bd7920386cdaa6fee14af8530f1f64b695338f70e77a33630. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	0930ef784776826bd7920386cdaa6fee14af8530f1f64b695338f70e77a33630
SHA3-384 hash:	5036e82b689d3880db811c46a4b51a88640f24add258c422753cbd18d5d9e2f3ce873ab3b39d47ba54643cc5f09fde15
SHA1 hash:	0e56401c106b20accc224db3c434e2f5c1bb3166
MD5 hash:	417b7dc8be96d72fd642e4976fc21f51
humanhash:	lamp-chicken-comet-equal
File name:	UnHAnaAW.m68k
Download:	download sample
Signature	Mirai Create hunting rule
File size:	97'088 bytes
First seen:	2025-10-17 17:34:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:tknyK/yAf8HPo44wq/iSI85IJrYSDbplY4bN5T73Z9TObvQH:tk9wv0iSMVXpljbn/q8
TLSH	T177935CD9F8019D7CF85BD6BE80130A49B530A35156930F3FA65AFDD36C721A86E12E81
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin masquerade mirai obfuscated obfuscated remote threat

Link:

https://www.filescan.io/uploads/68f2817fdf5cb32bf1f15612/reports/b1439fd4-dfd4-4678-92b2-b69885d69aff/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-10-17T15:01:00Z UTC

Last seen:

2025-10-18T10:13:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/0930ef784776826bd7920386cdaa6fee14af8530f1f64b695338f70e77a33630/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d6aa2bc2-d539-4fa0-b264-7664ee243d08

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f232817e-be6b-4cda-b792-e74272f9cc7a

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1797304

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/0930ef784776826bd7920386cdaa6fee14af8530f1f64b695338f70e77a33630/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-17 17:43:29 UTC

File Type:

ELF32 Big (Exe)

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=beyo66cho2bgxv4saodm3ktp5ykk7bjq6h3ew2kthd3q455dgyya._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:echobot family:mirai linux

Link:

https://tria.ge/reports/251017-wdaacadt6h/

Verdict:

Unknown

Tags:

botnet mirai

YARA:

MAL_ELF_LNX_Mirai_Oct10_1

Link:

https://app.threat.zone/submission/e442260d-5de4-4a9f-9a4a-b690e338dd40

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0930ef784776826bd7920386cdaa6fee14af8530f1f64b695338f70e77a33630

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CVE_2017_17215 Create hunting rule
Author:	NDA0E
Description:	Detects exploitation attempt of CVE-2017-17215

Rule name:	ELF_Mirai Create hunting rule
Author:	NDA0E
Description:	Detects multiple Mirai variants

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	MAL_ELF_LNX_Mirai_Oct10_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects ELF Mirai variant
Reference:	Internal Research