MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 112e661fdbf773621307af891692daaff1e5464174cfae11b45b4b73ea5aa379. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 112e661fdbf773621307af891692daaff1e5464174cfae11b45b4b73ea5aa379
SHA3-384 hash: 21573cf07816acd1a87a183778cc72ff56ea2efb272734c6b63f0f746ef584a4e91c8e9c310454fb1f5ac0142ec20329
SHA1 hash: fb30d4f4d34f746f2a53f330fb2afea134c36f4d
MD5 hash: 6e89db6b42d21ec92c6acd3d5cdbe1d6
humanhash: lithium-seventeen-blossom-rugby
File name:powerpc.uhavenobotsxd
Download: download sample
Signature Mirai
Create hunting rule
File size:95'540 bytes
First seen:2025-12-24 19:58:32 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:ReT94UTnUrxJidMh6HnYzz6Dyt9+jxV+q6nSw9ZV6x:aVTkcdMh6Hn4x+NV13x
TLSH T199936D02B31C0A43E1A76D743B3F27C5D3DAAA9112F4B689250EBB46D072A32554BFDD
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30455.LC.BadVar.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-10001386-0
Create hunting rule

Unix.Trojan.Mirai-10010119-0
Create hunting rule

Unix.Trojan.Mirai-10010127-0
Create hunting rule

Unix.Trojan.Mirai-10017351-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/694c461284afa5547b5d9865/reports/adc7bffc-99df-451b-aad6-d57f6d975d69/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/fecc2e07-16cd-48bf-9a50-2ff21a0a831c
Behavior Graph:
Download SVG
%3 guuid=89e65d9f-1600-0000-6218-e7e3930c0000 pid=3219 /usr/bin/sudo guuid=626374a2-1600-0000-6218-e7e3950c0000 pid=3221 /tmp/sample.bin guuid=89e65d9f-1600-0000-6218-e7e3930c0000 pid=3219->guuid=626374a2-1600-0000-6218-e7e3950c0000 pid=3221 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e82d90b4-9e4f-4d7c-9fa4-4291c5c7d4cd
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1839070
Signature
Drops files in suspicious directories
Drops invisible ELF files
Executes the "crontab" command typically for achieving persistence
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Terminates several processes with shell command 'killall'
Writes identical ELF files to multiple locations
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 1839070 Sample: powerpc.uhavenobotsxd.elf Startdate: 24/12/2025 Architecture: LINUX Score: 88 9 powerpc.uhavenobotsxd.elf 2->9         started        12 dash rm 2->12         started        14 dash rm 2->14         started        signatures3 101 Sample reads /proc/mounts (often used for finding a writable filesystem) 9->101 16 powerpc.uhavenobotsxd.elf 9->16         started        process4 file5 75 /var/spool/cron/root, ASCII 16->75 dropped 77 /var/spool/cron/crontabs/root, ASCII 16->77 dropped 79 /root/.bashrc, ASCII 16->79 dropped 81 11 other files (10 malicious) 16->81 dropped 93 Sample tries to set files in /etc globally writable 16->93 95 Sample tries to persist itself using /etc/profile 16->95 97 Drops files in suspicious directories 16->97 99 4 other signatures 16->99 20 powerpc.uhavenobotsxd.elf sh 16->20         started        22 powerpc.uhavenobotsxd.elf sh 16->22         started        24 powerpc.uhavenobotsxd.elf sh 16->24         started        26 46 other processes 16->26 signatures6 process7 process8 28 sh cp 20->28         started        32 sh crontab 22->32         started        34 sh 22->34         started        36 sh cp 24->36         started        38 sh cp 26->38         started        40 sh cp 26->40         started        42 sh rm 26->42         started        44 44 other processes 26->44 file9 83 /usr/bin/.update, ELF 28->83 dropped 103 Writes identical ELF files to multiple locations 28->103 105 Drops invisible ELF files 28->105 107 Drops files in suspicious directories 28->107 85 /var/spool/cron/crontabs/tmp.WwCLIq, ASCII 32->85 dropped 109 Sample tries to persist itself using cron 32->109 111 Executes the "crontab" command typically for achieving persistence 32->111 46 sh crontab 34->46         started        87 /boot/.update, ELF 36->87 dropped 89 /var/jbx/shared/.update, ELF 38->89 dropped 91 /var/log/.update, ELF 40->91 dropped 113 Sample deletes itself 42->113 115 Terminates several processes with shell command 'killall' 44->115 49 S99backup0 44->49         started        51 S99backup1 44->51         started        53 S99backup2 44->53         started        55 5 other processes 44->55 signatures10 process11 signatures12 117 Executes the "crontab" command typically for achieving persistence 46->117 57 S99backup0 .update 49->57         started        67 5 other processes 49->67 59 S99backup1 .update 51->59         started        69 5 other processes 51->69 61 S99backup2 .update 53->61         started        71 5 other processes 53->71 63 S99network .update 55->63         started        65 .monitor .update 55->65         started        73 8 other processes 55->73 process13
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/112e661fdbf773621307af891692daaff1e5464174cfae11b45b4b73ea5aa379
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/112e661fdbf773621307af891692daaff1e5464174cfae11b45b4b73ea5aa379/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cexgmh6365zweeyhv6ernew2v7y6krsboth24enulnfxh2s2un4q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251224-yp4pfabx8h/
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-10001386-0
YARA:
n/a
Link:
https://app.threat.zone/submission/b7902a4a-6141-41b8-a26a-8ef0879da627
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202503_elf_Mirai
Create hunting rule
Author:abuse.ch
Description:Detects Mirai 'TSource' ELF files
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 112e661fdbf773621307af891692daaff1e5464174cfae11b45b4b73ea5aa379

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3686380/
  
Delivery method
Distributed via web download

Comments