MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a
SHA3-384 hash:	e75db02e594f7458ee003144b4e7127225bd169cba6b719f703d29649598e43b2a7e5d6b7d5488f863bf389f35d7da99
SHA1 hash:	0f4341c603a17f2b7a6d91b5843dc33057c02e97
MD5 hash:	9c5ed7b4c92692ec78535a67003bca45
humanhash:	oregon-friend-alanine-snake
File name:	narmv5l
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	115'476 bytes
First seen:	2025-06-26 11:17:45 UTC
Last seen:	2025-06-26 16:10:33 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:zcrxy7KbYS3FvAbRPiwd3qz8WERras3ZTAxHhx:zIYBbtiwd3qoBIsJT8Hhx
TLSH	T1D2B33A99FC409B16C5E02ABBFE6D51CD33230FB8E2DA7106DC156F2067DA91A0E7B641
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

94

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685d2c8eb06783b9ebd80334linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sends data to a server

DNS request

Connection attempt

Receives data from a server

Runs as daemon

Substitutes an application name

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

20

Number of processes launched:

6

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 74.125.250.129:19302

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/20676f38-0600-40d9-a44f-5251233f0c0c

Behavior Graph:

Download SVG

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e70f504f-67c5-4723-8c65-b69b29c4b7c1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1723413

Signature

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-26 11:18:35 UTC

File Type:

ELF32 Little (Exe)

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ebhoauerzeybdaifivthwqja5xb7be3m75cdkqgyldflqvrkb5fa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery

Link:

https://tria.ge/reports/250626-nekhpsfq8s/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Changes its process name

Reads process memory

Reads MAC address of network interface

Reads network interface configuration

Renames itself

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ce935571-e28c-4d4a-8062-ccd1352b0480

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a