MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5
SHA3-384 hash:	df7150c534af692828cc2660f8d6890b9b54150f9db49d3e2f45372f682b2034aa38edb8fe864a7d2d5d9ae5966a24e2
SHA1 hash:	4e0d25e56c2cc7aedfed97e935caec5e32457639
MD5 hash:	f0a41751595d3375157ac4b5bfd70b1b
humanhash:	winner-connecticut-skylark-mississippi
File name:	Josho.spc
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	60'116 bytes
First seen:	2025-05-16 16:29:44 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3m:TXw00+SY3CaactfI6Hvzsv6vwcGJN
TLSH	T142432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Dropper.Mirai-7135890-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135939-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7136025-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682769df4a59e5a2ce054654linux22vpnfull_triage

Tags:

n/a

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/682768680de036ed65aa1cc1/reports/71c735ca-7bec-49ba-9ee1-24a6038f44a2/overview

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/822659c1-efb5-48b0-aea2-f5e9b215be5b

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1692215

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-16 16:32:12 UTC

File Type:

ELF32 Big (Exe)

AV detection:

25 of 37 (67.57%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d6d76n6gb6c6vj3vibud3vb6agunuawswpqp5rnm6emcmckvo7cq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:josho linux

Link:

https://tria.ge/reports/250516-t1nedacn51/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135890-0

YARA:

n/a

Link:

https://app.threat.zone/submission/948c1974-2b2c-40fb-8c23-0ed39a9f7991

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/1f87ff37c60f85eaa77540683dd43e01a8da02d2b3e0fec5acf11826095577c5