MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41
SHA3-384 hash:	c8b132308fc6bec6f1c60565da05d0cce63a07261937ad156f144cb4f492f2c34973a57567a3741453af81a6e021df32
SHA1 hash:	e6c1810929dd67caa6533048f33cd8001816e314
MD5 hash:	261b343ad079ade824f545cd90f3e49e
humanhash:	uncle-comet-jig-floor
File name:	armv7l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	145'088 bytes
First seen:	2025-11-30 10:42:45 UTC
Last seen:	2025-11-30 12:49:55 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:Odl77hhp+NbmuGD0zEPsBasV3tk3keN3Mu+Z4ckIOL8HkeyU:0x+9dIkEUBasdtk3keNcu+Z0IM8HkeyU
TLSH	T197E32756FD819F05D5D126BAFA5E528A33235BBCE3EE7112ED205B2123CA95F0F3A401
telfhash	t101a012004348190c49a8459103f44d219bad3040830000204241a94cce85e606cabd30
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Connection attempt

DNS request

Creating a file in the %temp% directory

Runs as daemon

Receives data from a server

Collects information on the OS

Locks files

Opens a port

Sends data to a server

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

expand lolbin mirai rust

Link:

https://www.filescan.io/uploads/692c1fc0d0d5e7288b51562b/reports/5048a40a-930a-4f81-a19d-58edcd04124f/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41

Behaviour

Anti-VM

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/36d7d732-0a94-4442-b5d6-ae48071e9629

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e38a0eaa-805a-4a88-bd20-2088fa2c1888

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1823073

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dm57i5z66sbq6xjgqj4zofy3gc7kayazyta755vimfh5ydwsrzaq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/251130-mscjkshj4z/

Behaviour

Reads runtime system information

Writes file to tmp directory

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fd4630dd-9bc2-48a4-acb6-c20d560dcdc6

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1b3bf4773ef4830f5d26827997171b30bea06019c4c1fef6a8614fdc0ed28e41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.