MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7
SHA3-384 hash:	08e110ae1cceac6f3236dcc715d6e0af7e0299624633ed7d8d8b2c1f524d8c8fc68ca10c0377418d661fd587f73db7bf
SHA1 hash:	cc4cb59006b05f3de7a23d0778713e9436cdd342
MD5 hash:	13876eb13d0adae21d5630d1b4b303d5
humanhash:	foxtrot-fruit-sad-mango
File name:	boatnet.mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	84'316 bytes
First seen:	2025-12-02 15:07:36 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:3r6zjM89GwM8NqvENaHLmNaHHU5knjqbXjgjPP6xRmJEav5YeWtkIxil4HQpcMvA:3O7GWDUoku7mXQ+4H0juuct6EqP6GISU
TLSH	T17583FD2DFD164F7EFA9B413456AE9E166D6423C537D1E042E2BC97602DA120B380AEDC
telfhash	t10801125c893812f4d7725d9a6b6dfeb6e05130df45025e378e10fc5d9b5e5418e00c1c
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 c28b4174ebab5aad08afdfe2fc9cc262fd7979061a3a5f7f95fcb36fdf1f02c6

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	24'968 bytes
File size (de-compressed) :	84'316 bytes
Format:	linux/mips
Packed file:	c28b4174ebab5aad08afdfe2fc9cc262fd7979061a3a5f7f95fcb36fdf1f02c6

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Mirai

Details

Mirai

an XOR decryption key and at least a c2 socket address

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

botnet masquerade mirai

Link:

https://www.filescan.io/uploads/692f00e24c1198e16ff148af/reports/4bf4bb0b-a840-4672-937b-1c1701da7c8a/overview

Result

Gathering data

Result

Threat name:

Mirai

Detection:

malicious

Classification:

spre.troj

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1824517

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-12-02 15:08:21 UTC

File Type:

ELF32 Big (Exe)

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cxjczxtlfohlk37nqhjrjn54t3u6lgy2mmo3b7nxjjkxyd76mddq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd defense_evasion discovery

Link:

https://tria.ge/reports/251202-sh2nlswrep/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to system bin folder

Modifies Watchdog functionality

Verdict:

Malicious

Tags:

botnet mirai trojan gafgyt Unix.Dropper.Mirai-7136013-0

YARA:

Mirai_Botnet_Malware Linux_Trojan_Gafgyt_28a2fe0c Linux_Trojan_Gafgyt_ea92cca8 Linux_Gafgyt_May_2024

Link:

https://app.threat.zone/submission/a34cf4eb-d45c-43e8-813d-adf32b9d69c0

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_Yakuza Create hunting rule
Author:	NDA0E
Description:	Yakuza botnet

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Trojan_Gafgyt_28a2fe0c Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Gafgyt_ea92cca8 Create hunting rule
Author:	Elastic Security

Rule name:	Mirai_Botnet_Malware Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research