MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f
SHA3-384 hash:	6ba03232cea67fd3176d2382746c901fb642302dee474e1b4b40ae86c314d21f086c673658352359203be0cd2a1b3113
SHA1 hash:	ca2eced5f09ce85047b6fbacf35505f9c6d2f137
MD5 hash:	e185be698cf098fc3c58ad04c55455bb
humanhash:	monkey-florida-kansas-music
File name:	kvariant.m68k
Download:	download sample
Signature	Mirai Create hunting rule
File size:	90'568 bytes
First seen:	2025-11-03 22:20:26 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:1aseTISPNFZKN8N6vCK+oSzycwJntxOh503vn7fF/nTYgSjv3Qxgq6:8seFZK5CnoMycwJOhCfJMgSjvAeq6
TLSH	T140934AD7FC00ED7EF80DD73B4453490AB230A3A11A832A766247747BED3A1985967F86
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

131

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.29524.LC.UNOFFICIAL

Unix.Trojan.Mirai-6981989-0

Unix.Trojan.Gafgyt-7782058-0

Unix.Exploit.Mirai-9798002-0

Unix.Trojan.Mirai-9940650-0

Unix.Dropper.Mirai-9977145-0

Unix.Trojan.Mirai-10018298-0

Gathering data

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-11-03T20:22:00Z UTC

Last seen:

2025-11-03T20:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a96f5e60-6f2e-4a36-a583-02e714b18de9

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/df4ff2f3-e25a-4b60-9dce-27808c17f7a4

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1807321

Signature

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/20f1d0f8dbe7f5a155ae50e9b2b4909ee70b1bcd3c1eaddab374b4e47b2a1f4f/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-11-03 22:21:48 UTC

File Type:

ELF32 Big (Exe)

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=edy5b6g34722cvnokdu3fneqt3tqwg6nhqpk3wvtos2oi6zkd5hq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251103-19m9aszrht/

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-6981989-0

YARA:

n/a

Link:

https://app.threat.zone/submission/1daa5c8f-2147-438a-95fe-b733d6fca17a

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.