MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620
SHA3-384 hash:	14e6d9ed4c605b02ed4bea6b5f9aaa37b83da854316b5785a4fe2e190ce5bb4abc0f34e22328dcc0c2d83d05d7118497
SHA1 hash:	5c5d7c4b1156be62fae8c0a5b1e33c60a8ba1d6e
MD5 hash:	695635d70373954dab41cbf19b6cbe9b
humanhash:	louisiana-bacon-bravo-hamper
File name:	morte.arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	91'852 bytes
First seen:	2025-07-14 18:05:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:q5LnSeSuFQ9GEuC0BhMZVHsWLhs54L2a/LhkpVuUgil1i/8CL7KJY1oE:qceSuFQgBe0WVs6L2a/I1i/8CLmJa
TLSH	T1CF932A5AFD818B21D5C502BAFA1E118E3313177CE2EE73129D146F21778B96B0E7B846
telfhash	t1d721fe95d7c80be877d08b5dc1cc623f286930ed6a11395bd76d272f0b26ec03020835
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 b47956522c66866e7b5356a4f242b2404169f22c94305b722999c0af8f0a0afc

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	42'440 bytes
File size (de-compressed) :	91'852 bytes
Format:	linux/arm
Packed file:	b47956522c66866e7b5356a4f242b2404169f22c94305b722999c0af8f0a0afc

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

masquerade rust

Link:

https://www.filescan.io/uploads/6875473112460d69545d6452/reports/8d2d8481-0256-4ef9-a14e-6b2b41c3cb93/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9a2d9145-fd35-446a-909d-5728a8e3936e

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

Mirai, Xmrig

Detection:

malicious

Classification:

troj.mine

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1736409

Signature

Found strings related to Crypto-Mining

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620/

Verdict:

Malicious

Threat:

Linux.Worm.Mirai

Link:

https://tip.neiki.dev/file/1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-07-14 18:06:33 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ckd6m67y6v5aes4mcgst7qkxzlkkvquxl6s2e2oaelslfaf26yqa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/250714-wpyr3swtat/

Malware Config

C2 Extraction:

last.galaxias.cc

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/91168775-923b-4d6d-96d4-090ede21aa99

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.