MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e39587a24420de89fd4b39ab8d997098a4b1ca76b5685a75725a199f50f7e95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	1e39587a24420de89fd4b39ab8d997098a4b1ca76b5685a75725a199f50f7e95
SHA3-384 hash:	6ae40fa0bf3efed7397b79fa62bf0b044dfee05df7e1eabe3625c5d78bed9aa8bdb5160eb8f2dfccd51e68179bab2c81
SHA1 hash:	c06f0031f5f932f46815ccf9438e93c86a88a4fc
MD5 hash:	856be7e6a6b609d3f21b1965bf61caa8
humanhash:	massachusetts-nitrogen-ink-hawaii
File name:	xnxnxnxnxnxnxnxni386xnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	86'716 bytes
First seen:	2025-12-26 06:23:28 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:PhIpv93p+se0Iapp3ErQkrf5VP1gh5IY6hzzUMUUr:PhIpV3I0IRQkrBVKIY6ZH
TLSH	T170833B85E6B2E0F0E18701B00257F3EA4934EA345415CED9EB6A3D70EDB17829D9B72C
telfhash	t1d04122fb1daa0ee4f7d0a443d70f2be15d1eeab71a2132e600b2695133e2e918175c34
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 744704c65299ab114c1394aa7a91e84d60764861048ee4e0149f212a6e410111

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	45'540 bytes
File size (de-compressed) :	86'716 bytes
Format:	linux/i386
Packed file:	744704c65299ab114c1394aa7a91e84d60764861048ee4e0149f212a6e410111

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Mirai-10056451-0

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

gafgyt mirai rust

Link:

https://www.filescan.io/uploads/694e2a11a7163552ba0509f4/reports/609c6d93-a592-41dc-8cef-ca4b51e4d02a/overview

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/37ed7cc4-5743-4a37-b29b-bf9a495460d4

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d3e7687e-222c-4425-98f1-652ed4910d6a

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1839644

Signature

Connects to many ports of the same IP (likely port scanning)

Deletes system log files

Manipulation of devices in /dev

Sample tries to kill a massive number of system processes

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1e39587a24420de89fd4b39ab8d997098a4b1ca76b5685a75725a199f50f7e95

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/1e39587a24420de89fd4b39ab8d997098a4b1ca76b5685a75725a199f50f7e95/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dy4vq6reiig6rh6uwonlrwmxbgfewhfhnnlilj2xewqzt5ipp2kq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/251226-g57bts1rgq/

Behaviour

Reads runtime system information

Changes its process name

Reads system network configuration

Reads process memory

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

Deletes Audit logs

Deletes journal logs

Deletes system logs

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-10056451-0

YARA:

n/a

Link:

https://app.threat.zone/submission/ac791a5c-0735-4f6b-b846-15d8bcc9e855

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/1e39587a24420de89fd4b39ab8d997098a4b1ca76b5685a75725a199f50f7e95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.