MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bc7bdccc8009ee9105f9fe7d96eb62c7aeda2ce42fc3cae02a51b939b2feed3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: 0bc7bdccc8009ee9105f9fe7d96eb62c7aeda2ce42fc3cae02a51b939b2feed3
SHA3-384 hash: c7fef951bd41211ceb07df0ba35089636df2d4f33a06561f6db2522fce27b1b1ce50fe8517c927772d959a8d13e3b219
SHA1 hash: 33e809a6939d56013fce1609bfae3d2b5951cb70
MD5 hash: 121cf31c1d4752a1cc87afb6b140cc23
humanhash: alanine-bravo-sweet-oranges
File name:spc
Download: download sample
Signature Mirai
File size:74'900 bytes
First seen:2025-11-02 06:03:31 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:PODjxpVIfWLDn6fwmb4ne4et+iUt5nssdtodctB:mpfvnpY0v/nswr
TLSH T1A1733A22B9360D27C5C0A87621F34775F2F6538A26ECCA1E7D620D4EBF2465031976FA
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
159
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-11-01T23:37:00Z UTC
Last seen:
2025-11-02T06:19:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=794d0865-1900-0000-fc12-655b64140000 pid=5220 /usr/bin/sudo guuid=bfcbb467-1900-0000-fc12-655b65140000 pid=5221 /tmp/sample.bin guuid=794d0865-1900-0000-fc12-655b64140000 pid=5220->guuid=bfcbb467-1900-0000-fc12-655b65140000 pid=5221 execve
Result
Threat name:
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
Antivirus / Scanner detection for submitted sample
Manipulation of devices in /dev
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1806387 Sample: spc.elf Startdate: 02/11/2025 Architecture: LINUX Score: 68 19 flibberwock.cfd 185.14.92.55, 23, 34306, 34308 INTERCOLO-ASintercoloIP-BackboneDE Germany 2->19 21 109.202.202.202, 80 INIT7CH Switzerland 2->21 23 4 other IPs or domains 2->23 25 Antivirus / Scanner detection for submitted sample 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected Mirai 2->29 7 spc.elf 2->7         started        9 dash rm 2->9         started        11 dash rm 2->11         started        signatures3 process4 process5 13 spc.elf 7->13         started        file6 17 /dev/.392221, ASCII 13->17 dropped 31 Manipulation of devices in /dev 13->31 signatures7
Threat name:
Linux.Backdoor.Mirai
Status:
Malicious
First seen:
2025-11-02 06:04:32 UTC
File Type:
ELF32 Big (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:mirai linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 0bc7bdccc8009ee9105f9fe7d96eb62c7aeda2ce42fc3cae02a51b939b2feed3

(this sample)

  
Delivery method
Distributed via web download

Comments