MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba
SHA3-384 hash:	655047a26ad572378bec3a063d6521701cddede49ed24d2e3414d5ca69abcaadc3861139b21688ca629bdecb73acfbe8
SHA1 hash:	dbcb5e0633e3af1d1573cc1d6fec677ce75e5920
MD5 hash:	13e3634aadb7e3f2a9191e60bfdd93fa
humanhash:	beryllium-social-freddie-angel
File name:	xnxnxnxnxnxnxnxnx86_64xnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	136'064 bytes
First seen:	2025-10-31 23:27:01 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:lBFrarnk46K3CvWx8Ynvk9h5ouslcLF8U8YYTg:39snL3CvhrslcZ8tng
TLSH	T196D35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937EE15E15F61
telfhash	t1c331eeb14e9a366812c7a712f319bf69f073150205f1f4e99d376de8ce123824fa30a2
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 e13acec6530fa4f3e6ec4fb1d1ff9712171a3e007cb2a959585448c7cbecf13a

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	63'888 bytes
File size (de-compressed) :	136'064 bytes
Format:	linux/amd64
Packed file:	e13acec6530fa4f3e6ec4fb1d1ff9712171a3e007cb2a959585448c7cbecf13a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Mirai-10056451-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Kills processes

Locks files

Creating a file in the %temp% directory

Connection attempt

Substitutes an application name

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/690545eea3d163109524aed2/reports/4da898ec-ec10-45e1-9354-48cffcd03dd1/overview

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2025-10-31T20:53:00Z UTC

Last seen:

2025-11-02T01:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0cb57441-3239-4507-b5c2-8ec7335a1519

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4c483eab-cb26-4e8a-9ee3-b615a99ce058

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1806112

Behaviour

Behavior Graph:

n/a

Score:

99%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-31 23:27:30 UTC

File Type:

ELF64 Little (Exe)

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cqzzueep6pcabtuptfsvnt74cs2qqnvi2f4g3kfbo3ynyucgkk5a._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/251031-3fnzvabt8f/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Enumerates active TCP sockets

Enumerates running processes

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/14339a108ff3c400ce8f996556cffc14b50836a8d1786da8a176f0dc504652ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.