MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments 1

SHA256 hash:	1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846
SHA3-384 hash:	a98e80b498e95f8d21142aaa78c675c71f09591ce2049ac3d5c2d051d55be7fbbece00fc6e6be6ae1e4d33994a117ae1
SHA1 hash:	e3d07d2b7711b2cd90a7b858a399b7d25db93680
MD5 hash:	3f3b50ea98c724a49e54c9ecfaed85bf
humanhash:	cold-angel-fanta-thirteen
File name:	1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846
Download:	download sample
Signature	Mirai Create hunting rule
File size:	75'056 bytes
First seen:	2026-10-25 02:24:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:5NnpuPjDPshNucOlmMgV2calyac6I9ibFxfVqTn+353Y3:QPjzsHuplm94cabFtVqTn+3tc
TLSH	T13F73F756B8818B12D5D502BAFE1E118E33131B7CE3DEB3129D206B24778B96F0E77916
telfhash	t13501f4498dcc6bccc7f04b09c35db52235c275e5a773006e4d7f2c5e02128c23431825
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	spydisec
Tags:	arm cowrie elf honeypot mirai

spydisec

Captured by an SSH/Telnet honeypot (cowrie): second stage named in the attacker's dropper script, fetched once by the sensor and never executed. Downloaded from http://176.65.139.51:6674/donkeypussy/deathstararmv6l; attacker IP(s): 176.65.149.4; first seen 2026-10-25T02:23:20Z.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware configuration found for:

Mirai

Details

Link:

https://research.acce.ciphertechsolutions.com/results/00e5af79-efd6-4c3c-8a61-cdde9465b560/

Detection(s):

Unix.Trojan.Mirai-9951087-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

rust

Link:

https://www.filescan.io/uploads/6add6854946f66b4fffcf8a5/reports/a8447923-9c5b-47d7-8008-f3ce7f98d7a1/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5a857d52-4d10-4e78-bd59-b2590e547ac2

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6bb701a8-6373-453d-89a0-7df8e5a71c1c

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2026-10-25 04:01:13 UTC

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d5yvefrwpt63jy4x2qxj7jtf26b4daxk6kv4j5ltccye3ud6vbda._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet

Link:

https://tria.ge/reports/261025-cvv4lafs4j/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	Linux_Generic_Threat_c19ca8e5 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Generic_Threat_d2dca9e7 Create hunting rule
Author:	Elastic Security

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 1f715216367cfdb4e397d42e9fa665d783c182eaf2abc4f57310b04dd07ea846

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3998768/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Dense commented on 2026-10-25 02:58:27 UTC

Static analysis and structural caveat for this fresh community ARM ELF, 2026-10-24 America/New_York. SHA-256 verified; sample never executed. At file offset 0x109b8 the XOR-0x26 string decrypts to devs.homelabnode.qzz.io. Declared section layout contains table_key 0x08f39449, whose four bytes XOR to 0x26; table unlock routine 0xec4c applies those key bytes. Main unlocks entries 0-3, resolves the host table and stores a selected address into sockaddr. At 0xe1cc-0xe1d8, mvn 0x2080 followed by subtract 0x13 yields halfword 0xdf6c: ARM little-endian memory 6c df gives network-order port 27871. Related SPARC sample d332dc8d033bf9687075a977ec3120bee7fcc4586592cc986fd432bb5525f7bc independently constructs port 0x6cdf and has the identical encrypted domain. Important limitation: this ARM file has a four-byte discrepancy between writable-section file offsets and their PT_LOAD-derived offsets. Configuration above is decoded from declared section layout; runtime viability is unverified. Preserve this anomaly rather than silently repairing/reuploading it or treating it as a distinct working bot variant. No repaired executable was written, no execution and no C2 TCP contact.