MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572
SHA3-384 hash: 1b4074fa0ae031eaa1034feae28a6b039ed20b48bdb7d9ab2a9658f933971398ef8a93aec965b099fab2eef9fcb881d5
SHA1 hash: 96adc9a8b2d86b7f0861ccfdb7167a176ddd6cba
MD5 hash: 84b1a7be96716aa10f7b82ab43851782
humanhash: fix-montana-nineteen-alaska
File name:13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572.elf
Download: download sample
Signature Mirai
Create hunting rule
File size:85'908 bytes
First seen:2026-08-23 20:03:24 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 1536:F5U/dEZJueRMsH6iFrv2b1GYAZnXiWVHuSzbwDKMhJ9jCMk4OKs5v51qfghfx:z4d8TdH6oa1GYSXiWV5IFhL+9K5Ihp
TLSH T1668312961385B114D2C04D3AB87D71A7E6C3B21B613B19769127F296C8E2CC339FED91
Magika elf
Reporter whack_sh
Tags:elf exe UPX whack.sh
File size (compressed) :85'908 bytes
File size (de-compressed) :194'220 bytes
Format:linux/arm
Unpacked file: 7faf0bb6ba91b41baa4a9ec4b120fd7d81773df5f16fcc60c80c542135eff88c

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f7819943-6cc9-4c37-b133-b62524836f80/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Opens a port
Changes the time when the file was created, accessed, or modified
Changes access rights for a written file
Launching a process
Connection attempt
Sets a written file as executable
Runs as daemon
Creates or modifies symbolic links
Receives data from a server
Creating a file
Sends data to a server
Creates or modifies files in /cron to set up autorun
Substitutes an application name
Writes files to system directory
Deleting of the original file
Creates or modifies files in /init.d to set up autorun
Creates or modifies symbolic links in /init.d to set up autorun
Creates or modifies files to set up autorun
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/6a8b523e64e0ea1baf1b92d0/reports/1c9ee113-3295-4771-b697-9dc649346748/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0badca2e-225d-48b1-9dbc-2bd47e215d9f
Behavior Graph:
Download SVG
%3 guuid=a72491bc-1b00-0000-833e-255d73080000 pid=2163 /usr/bin/sudo guuid=f909c1bf-1b00-0000-833e-255d78080000 pid=2168 /tmp/sample.bin guuid=a72491bc-1b00-0000-833e-255d73080000 pid=2163->guuid=f909c1bf-1b00-0000-833e-255d78080000 pid=2168 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fefeca87-0b48-489c-8c89-869310c18329
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=coax2uxz6e54niwyxx45pkksqda4jz5hi5mfneepl3mow2jp2vza._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution persistence privilege_escalation upx
Link:
https://tria.ge/reports/260823-ytcfravtht/
Behaviour
Reads runtime system information
Changes its process name
Modifies Bash startup script
UPX packed file
Creates/modifies Cron job
Creates/modifies environment variables
Modifies init.d
Modifies rc script
Modifies systemd
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:elf_arm_mips_ko_so
Create hunting rule
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 13817d52f9f13bc6a2d8bdf9d7a95280c1c4e7a7475856908f5ed8eb692fd572

(this sample)

Mirai

elf 7faf0bb6ba91b41baa4a9ec4b120fd7d81773df5f16fcc60c80c542135eff88c

  
Delivery method
Distributed via web download
  
Dropping
SHA256 7faf0bb6ba91b41baa4a9ec4b120fd7d81773df5f16fcc60c80c542135eff88c
  
Dropping
MD5 ed968084da19a4506af9ec74b49d6f0d
  
URLhaus
https://urlhaus.abuse.ch/url/3885288/
  
URLhaus
https://urlhaus.abuse.ch/url/3892132/
  
URLhaus
https://urlhaus.abuse.ch/url/3892139/

Comments