MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b
SHA3-384 hash:	d61644075dcfb030b93f4eeba89e72bd2c88b8f5699c95e0ee5cfe20f5498646897dedb3ed0d413d66aa92adcd93401d
SHA1 hash:	2de137e9366f643a14aa3a55bd30eff70a45db84
MD5 hash:	a49b8bffa33f7df4d892ab680ac3ecee
humanhash:	ohio-charlie-early-georgia
File name:	mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	93'336 bytes
First seen:	2025-09-25 22:01:05 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:GXRJblevPRgXS5zy8o93ovrwjdUGrMv91KtyTbCeZ3zN3fb+FR/CdH2C0C8cZ/YE:GXRJblevPRgXS5zxo93ovrShjtyTT3zP
TLSH	T15993E94E2E75DFADF369C33447B74E31A3A923D523E1C685D2ACD5011E6024E642FBA8
telfhash	t146217f18497812f4a7751d9e1aedff76e5a130df0a265e378e00e9ad966d9428e00c1c
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai-13.UNOFFICIAL

Unix.Malware.Mirai-9942689-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Opens a port

DNS request

Mounts file systems

Runs as daemon

Creating a file

Sends data to a server

Connection attempt

Substitutes an application name

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68d5bbd874e5a2898993b066/reports/23a5ab31-29a7-443f-8085-467b00c9f89f/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.be

Detections:

HEUR:Backdoor.Linux.Gafgyt.fj

Link:

https://opentip.kaspersky.com/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cdc938cf-16e0-445f-accf-15d99a9bd628

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7b7a60e9-21ea-4f7e-9d1c-6bbd2837aab7

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1784510

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b/

Verdict:

Malicious

Threat:

Backdoor.Linux.Gafgyt

Link:

https://tip.neiki.dev/file/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-09-25 22:01:49 UTC

File Type:

ELF32 Big (Exe)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c3axw5ydqval6ntejfy5hdzggvyiwtsoddwrekxtfkfu3rzs4jnq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250925-1xljyayvd1/

Behaviour

System Network Configuration Discovery

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ab4804bc-16df-44a8-beb6-35954f482344

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/16c17b77038540bf36644971d38f2635708b4e4e18ed122af32a8b4dc732e25b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202503_elf_Mirai Create hunting rule
Author:	abuse.ch
Description:	Detects Mirai 'TSource' ELF files

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication