MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bb430acec89531cfff8a535d60302efd77f6daff5488df69868c92cc3c3f67f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bb430acec89531cfff8a535d60302efd77f6daff5488df69868c92cc3c3f67f
SHA3-384 hash: 30c8f0b6f0a5da3b755dea48427f427126d519ded7a385e78db5d856cc7a2a2a486bb68aac95fbe1baa678ec23d39431
SHA1 hash: c61206ea3e8ee6d65f8252c58f2d7de6c0db444a
MD5 hash: 70e0154afbd6189f12d1a03d47d32e88
humanhash: bluebird-pip-paris-nineteen
File name:arm
Download: download sample
Signature Mirai
Create hunting rule
File size:72'408 bytes
First seen:2025-12-31 06:18:31 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:bO5nJAWh7avDr4adj+EMrxZdc2jepgoNYrEy55/daCCxpyzL:bUnaWh7KDk8zGvEoaCyyv
TLSH T14B63F14C55EC65F3C84A28B25F3AC8803F3BA3D4E5BBF6750771EA0525DB1826979B02
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf UPX
File size (compressed) :72'408 bytes
File size (de-compressed) :204'904 bytes
Format:linux/arm
Unpacked file: 8497892405ea16b4ca5c38ec83a136d7cdc879112dbf71d71129921a5bda65cf

Intelligence

File Origin
# of uploads :
1
# of downloads :
31
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/73f65106-714d-49c4-a934-f501f1514891/
Detection(s):
SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai obfuscated packed upx
Link:
https://www.filescan.io/uploads/6954c06165e07687fdf318a8/reports/69c2da30-8a08-4bc4-aa37-1e3db5a85cb6/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/649bbc8f-0198-49ad-8a50-c73843ba0f5f
Behavior Graph:
Download SVG
%3 guuid=939e9ff4-1800-0000-3eb1-3547590a0000 pid=2649 /usr/bin/sudo guuid=007e7bf6-1800-0000-3eb1-35475f0a0000 pid=2655 /tmp/sample.bin guuid=939e9ff4-1800-0000-3eb1-3547590a0000 pid=2649->guuid=007e7bf6-1800-0000-3eb1-35475f0a0000 pid=2655 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/adaa7ac8-ff56-4172-a65e-828b3abf22ce
Result
Threat name:
Gafgyt
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1842563
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Gafgyt
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1842563 Sample: arm.elf Startdate: 31/12/2025 Architecture: LINUX Score: 60 35 169.254.169.254, 80 USDOSUS Reserved 2->35 37 151.242.30.13, 12121, 56252 RASANAIR Iran (ISLAMIC Republic Of) 2->37 39 5 other IPs or domains 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected Gafgyt 2->43 45 Sample is packed with UPX 2->45 8 arm.elf 2->8         started        11 python3.8 dpkg 2->11         started        13 dash rm 2->13         started        15 2 other processes 2->15 signatures3 process4 file5 33 /usr/local/bin/infinitd, ELF 8->33 dropped 17 arm.elf sh 8->17         started        19 arm.elf sh 8->19         started        21 arm.elf 8->21         started        23 2 other processes 8->23 process6 process7 25 sh systemctl 17->25         started        27 sh systemctl 19->27         started        29 arm.elf 21->29         started        31 arm.elf 21->31         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/1bb430acec89531cfff8a535d60302efd77f6daff5488df69868c92cc3c3f67f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bb430acec89531cfff8a535d60302efd77f6daff5488df69868c92cc3c3f67f/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=do2dblhmrfjrz77yuu25mayc57lx63np6vei35uyndeszq6d6z7q._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
upx
Link:
https://tria.ge/reports/251231-g23t8sck8z/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/db37617b-d17d-41ee-af5d-5a7fb26a3472
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 1bb430acec89531cfff8a535d60302efd77f6daff5488df69868c92cc3c3f67f

(this sample)

Mirai

elf 8497892405ea16b4ca5c38ec83a136d7cdc879112dbf71d71129921a5bda65cf

  
URLhaus
https://urlhaus.abuse.ch/url/3722797/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3722809/
  
Dropping
SHA256 8497892405ea16b4ca5c38ec83a136d7cdc879112dbf71d71129921a5bda65cf
  
Dropping
MD5 01ee004c3cc17442c79fdca8e4c71b95
  
URLhaus
https://urlhaus.abuse.ch/url/3719330/

Comments