MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16a52f948a3a2e438e2aa0ed744f3809615bb69c5273a4e823b54a7d777a7c16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	16a52f948a3a2e438e2aa0ed744f3809615bb69c5273a4e823b54a7d777a7c16
SHA3-384 hash:	5d9562859a883bed061f1364b3ea0d32fbc3de215adcedd495a4c4969e436de9d745f34a76954823d1f657c814e8cbcf
SHA1 hash:	55bd9d913df889922ee0c493601d9fb08fe7bbd9
MD5 hash:	99f7ca4c0685ec18fa6d883c9700a062
humanhash:	stream-twenty-louisiana-single
File name:	rep.arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	105'556 bytes
First seen:	2025-04-16 23:53:02 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:H0BAlQxGFdrlwBNz6Tqepa+u5AhZ1ePh0KMi0g:H0BLxGFdM6Oepax5AYo
TLSH	T147A3059AB8D18E62C5D502BFFA1F519D333253F8D2DFB213D8146B24778682B0D7A612
telfhash	t13ae02b3affbdcd4473ec08a550c44056c4dc71270e119d4790bc0b0f8902652f078469
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.31069.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Unix.Trojan.Gafgyt-6981160-0

Unix.Dropper.Mirai-7135893-0

Unix.Dropper.Mirai-7135900-0

Unix.Dropper.Mirai-7135951-0

Unix.Dropper.Mirai-7136105-0

Unix.Trojan.Mirai-7755770-0

Unix.Trojan.Mirai-7759336-0

Unix.Trojan.Mirai-7772538-0

Unix.Trojan.Mirai-8041689-0

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Mirai-9924065-0

Unix.Trojan.Gafgyt-9940653-0

Unix.Trojan.Mirai-9943763-0

Unix.Trojan.Mirai-9944690-0

Unix.Trojan.Mirai-9945195-0

Unix.Trojan.Mirai-10004218-0

Unix.Trojan.Mirai-10008934-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680046b72203b3e10ccfea74linux22vpnfull_triage

Tags:

vmdetect gafgyt mirai ddos

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-vm lolbin masquerade remote

Link:

https://www.filescan.io/uploads/680042e7931404048d7fb63d/reports/f4785d64-e2bd-424f-8ad4-6258881a4f73/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/16a52f948a3a2e438e2aa0ed744f3809615bb69c5273a4e823b54a7d777a7c16

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/91f5f28c-31ce-40c6-b7ee-fc90399ebad8

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1666848

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/16a52f948a3a2e438e2aa0ed744f3809615bb69c5273a4e823b54a7d777a7c16

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16a52f948a3a2e438e2aa0ed744f3809615bb69c5273a4e823b54a7d777a7c16/

Threat name:

Linux.Exploit.Mirai

Status:

Malicious

First seen:

2025-04-16 23:53:13 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c2ss7fekhixehdrkudwxitzybfqvxnu4kjz2j2bdwvfh2532pqla._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250416-3xccda1ps9/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.