MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9
SHA3-384 hash:	7ad26b6a2cdd218629f7956ff008f670edf5a0f2cb9a1382158f9365eebe5bc408007fa2a40a5c51edf8f4e73aa235b1
SHA1 hash:	321a5164b552768e3d592d1a773fb07d448174c2
MD5 hash:	6ad7d25d6a0b8f2af28f54d06d0264a7
humanhash:	triple-summer-echo-beryllium
File name:	xnxnxnxnxnxnxnxnmipsxnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	170'708 bytes
First seen:	2026-02-22 09:29:33 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:cRJdS3HLZE7w/FyoTQlNnIkV/Q/qdTPDAhKhxpO3/qzx/KfarA:EJE3rW80ocLnX/Q/sa+pOSmuA
TLSH	T198F34C0BB7108FA1C329D67009B38B67A6E7269216E19985E76DDD107B3035C6C3FFA0
telfhash	t1d9c002145c7457f15108dd5540dc7f29c5f51dcf15431d1fd9183c654631d831f00d59
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 a412e9d4b89be000db074fd0d3fabda7db829d712a7fff1a5ce90a7558e96534

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	75'548 bytes
File size (de-compressed) :	170'708 bytes
Format:	linux/mips
Packed file:	a412e9d4b89be000db074fd0d3fabda7db829d712a7fff1a5ce90a7558e96534

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Mirai-10056451-0

Unix.Trojan.Mirai-10058917-0

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

112

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9

Behaviour

Anti-VM

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.be

Link:

https://opentip.kaspersky.com/198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/362e7dfd-ad05-4bbe-8642-feab43401786

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e37ad199-01c5-4ff6-9f7e-09462817bfea

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-02-22 09:30:58 UTC

File Type:

ELF32 Big (Exe)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dggqiv7nyeyduqfilu73cla53rovyjuwusgqnj4rfg4eje4yqpmq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm discovery

Link:

https://tria.ge/reports/260222-lgs7hsew7h/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Enumerates active TCP sockets

Enumerates running processes

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.