MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46
SHA3-384 hash: 6e72860eb46ca291560245595a140c5c07a9d48395444fc317b1775a80293cbab894acf04833003cbf8244a1ad77aed2
SHA1 hash: 5ca5239a89e6ec2cb187da81e6034b7ae0c7a091
MD5 hash: 377ea79cf23d5a337b2bfe469f233cdf
humanhash: asparagus-red-vegan-sodium
File name:SecuriteInfo.com.ELF.Mirai-CQU.38112396
Download: download sample
Signature Mirai
Create hunting rule
File size:96'072 bytes
First seen:2026-01-19 08:20:26 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:IVsP234RLERmtT78zEos6T29bx4gPmnbeDlceH:mV4qRaT78zEolhgUaDWeH
TLSH T171936CA8764F7D91E3CBE37DCE454B72712B38F1C26192A4BE02532EC0DBD9989E0651
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter SecuriteInfoCom
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.ELF.Mirai-CQU.38112396.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
mirai rust
Link:
https://www.filescan.io/uploads/696de954fdafd7624ab09f50/reports/c7d4e448-65f6-4785-82b3-211ade4c3c72/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2026-01-19T03:51:00Z UTC
Last seen:
2026-01-19T22:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4d026c13-64ed-496a-9470-4e5cc9c3c441
Behavior Graph:
Download SVG
%3 guuid=a49230a8-1800-0000-8727-08afbf080000 pid=2239 /usr/bin/sudo guuid=52b74faa-1800-0000-8727-08afc4080000 pid=2244 /tmp/sample.bin guuid=a49230a8-1800-0000-8727-08afbf080000 pid=2239->guuid=52b74faa-1800-0000-8727-08afc4080000 pid=2244 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b532ca5-0232-4a60-a633-6bfcce8841c1
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 07:00:16 UTC
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpyz2hbhx55ygqnll7zw2j6rmuxcxd2zjjy3xomnlamby7j2dvda._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260119-j8q55ad19e/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2de47c22-9371-4f96-be44-951c5db0fcc1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 1bf19d1c27bf7b8341ab5ff36d27d1652e2b8f594a71bbb98d58181c7d3a1d46

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3760116/
  
Delivery method
Distributed via web download

Comments