🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd
SHA3-384 hash: 3802e043f5df9a60503610849b4cd901be004be7696b0ff33adcd81abd61850c18fe9f7f4e537b0946c01c3b2886d477
SHA1 hash: f25774a48f35f38ae75a561b9bd5b7d7acdff760
MD5 hash: 33811cdbaf844af0a418ae5dd64aa834
humanhash: king-nitrogen-indigo-florida
File name:flutter.debug
Download: download sample
Signature Mirai
Create hunting rule
File size:382'936 bytes
First seen:2026-10-06 16:11:03 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 6144:jzCrpyZVIlrUa/xKr6UThdJOJuIS3coagADZ:jO8W+rThquIS3c5
TLSH T15984496EF392D6AED10392720EFB46FC5730A0782730E24B3749393A293A5D1DE56716
telfhash t11701d3c49939de398f834a70ecb49798911259267413d725ef54c3e5943e149530cf5f
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter BlinkzSec
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
IN IN
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Dropper.Mirai-7135897-0
Create hunting rule

Unix.Dropper.Mirai-7135918-0
Create hunting rule

Unix.Dropper.Mirai-7135925-0
Create hunting rule

Unix.Dropper.Mirai-7135954-0
Create hunting rule

Unix.Dropper.Mirai-7136028-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

YARA.SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 gcc mirai obfuscated
Link:
https://www.filescan.io/uploads/6ac51e192c1b63dd12907d5c/reports/2d65a1fe-494a-463e-a37c-9cc19678006a/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
13
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5aee472f-5429-4f9e-b317-b920970fe916
Behavior Graph:
Download SVG
%3 guuid=3bb268a4-1a00-0000-1d54-8314280d0000 pid=3368 /usr/bin/sudo guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372 /tmp/sample.bin net send-data write-config write-file guuid=3bb268a4-1a00-0000-1d54-8314280d0000 pid=3368->guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con d025aea1-e7c6-54fb-aecd-35f446a920c1 94.154.43.34:6767 guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->d025aea1-e7c6-54fb-aecd-35f446a920c1 send: 10B guuid=26404faa-1a00-0000-1d54-8314310d0000 pid=3377 /tmp/sample.bin guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->guuid=26404faa-1a00-0000-1d54-8314310d0000 pid=3377 clone guuid=a76061aa-1a00-0000-1d54-8314320d0000 pid=3378 /tmp/sample.bin guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->guuid=a76061aa-1a00-0000-1d54-8314320d0000 pid=3378 clone guuid=5ece0aac-1a00-0000-1d54-8314380d0000 pid=3384 /usr/bin/systemctl guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->guuid=5ece0aac-1a00-0000-1d54-8314380d0000 pid=3384 execve guuid=1f884e23-1b00-0000-1d54-8314890e0000 pid=3721 /usr/bin/systemctl guuid=5b53d8a7-1a00-0000-1d54-83142c0d0000 pid=3372->guuid=1f884e23-1b00-0000-1d54-8314890e0000 pid=3721 execve guuid=40292bab-1a00-0000-1d54-8314350d0000 pid=3381 /tmp/sample.bin guuid=a76061aa-1a00-0000-1d54-8314320d0000 pid=3378->guuid=40292bab-1a00-0000-1d54-8314350d0000 pid=3381 clone
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/11995a79-4a2a-4acc-834d-e7b3c09ba514
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 16:06:34 UTC
File Type:
ELF64 Little (SO)
AV detection:
9 of 36 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkfottjkugd4u5ywjsuudzbmsbuv367d2mvygm3znds2hwfvzw6q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/261006-tm4jfaaw8s/
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1a8ae9cd2aa1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:deepfield_aisuru_ddos_botnet
Create hunting rule
Author:Nokia Deepfield ERT
Description:Aisuru DDoS botnet - Mirai derivative with custom crypto
Reference:https://blog.xlab.qianxin.com/aisuru-botnet-en/
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:Hunt_Obfuscated_Localhost_ROT
Create hunting rule
Author:Serhii Kocherhan
Description:Detects obfuscated/rotated 127.0.0.1 strings while excluding raw plaintext
Rule name:Linux_Generic_Threat_900ffdd4
Create hunting rule
Author:Elastic Security
Rule name:MAL_ARM_LNX_Mirai_Mar13_2022
Create hunting rule
Author:Mehmet Ali Kerimoglu a.k.a. CYB3RMX
Description:Detects new ARM Mirai variant
Rule name:MIRAI_OHSHIT_payload
Create hunting rule
Author:AfterPacket
Description:MIRAI_OHSHIT ELF payload -- compiled-in C2 set, all architectures
Reference:https://github.com/Afterpacket/drosera-threat-intel
Rule name:NSVPS_Hydra_SSH_Bruteforce
Create hunting rule
Author:sanad (NSVPS-SOC)
Description:Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:test_rule_vldslv
Create hunting rule
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 1a8ae9cd2aa187ca77164ca941e42c90695dfbe3d32b83337968e5a3d8b5cdbd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3943860/
  
Delivery method
Distributed via web download

Comments