MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112
SHA3-384 hash:	f40017784df58b0ed443831d1a6fc02864fd1deca1adcedaf2ea30c1d2ea94e4914be3b928aed75d126b83fdccc5b4cf
SHA1 hash:	6293ca4e2fcd527c3542a2c7dc558d13117846f2
MD5 hash:	0a278c9c4ceb0d6c193e4b3d359e8675
humanhash:	oven-hydrogen-fifteen-virginia
File name:	ttmswapd
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'172'316 bytes
First seen:	2026-02-18 18:59:23 UTC
Last seen:	2026-02-18 22:23:26 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	49152:wHglXUmrj4aY2Lc+q6CYfeIC8LV1GbEnfwxB6z58BBZ:wAFUmrjLY2Lnq6J1LV1yEk6GBT
TLSH	T132A5334C024F13CBCD3526A5051DB19AA21DA1F579321EBE03A9DE8ED53EB8C335A379
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	2'172'316 bytes
File size (de-compressed) :	8'192'148 bytes
Format:	linux/ppc64le
Unpacked file:	f4a5369dd39294481c01df5919b49d1bf2597ec88c848d3cf82321f1ce11738b

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-vm crypto packed upx

Link:

https://www.filescan.io/uploads/69960c6110e80629d4e9121b/reports/29b9f002-fb4d-463b-9c29-2cc2272e25c1/overview

Verdict:

Clean

File Type:

elf.64.le

Link:

https://opentip.kaspersky.com/0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cf5ed7a4-ec2b-4c04-bfb7-74fac5e8f3a4

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/aecf1f67-68a5-4e7f-91b9-76ffa4bb2a76

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1871442

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2026-02-18 19:13:57 UTC

AV detection:

5 of 24 (20.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bm2bur6mmigwqmt3qmnonywco2rx55qyuhzdofdohmwckhjsseja._file

Result

Malware family:

n/a

Score:

5/10

Tags:

linux upx

Link:

https://tria.ge/reports/260218-xn3kbafs6h/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries