MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6
SHA3-384 hash: 858384de8a1a9a17ad481e73ebeccd8e137ae965b23e04ecd196276ee79af6fccf5203b6a3145791cd35ec07991e4d78
SHA1 hash: 0863484b42a1db067f96f8146a44cf50df754f11
MD5 hash: 507b4c74da3fad85416d2a28567f657b
humanhash: tennis-delta-oscar-lemon
File name:arm
Download: download sample
Signature Mirai
Create hunting rule
File size:99'528 bytes
First seen:2025-04-02 06:36:25 UTC
Last seen:2025-04-03 02:50:20 UTC
File type: elf
MIME type:application/x-executable
ssdeep 3072:EqeiS14cqSuJd/oqiAD0u87jy0JpNRvO+Sl0FzOs41WldN:EPiSWHhJd9xF0jvzQwp41Wp
TLSH T138A3FA99B8919A57C5C506BFFE1F828C773653E8D2DB7203CE14AF21378B92A093B151
telfhash t18de0689b87982ead5bcc0651c8e2e22904bcb64e0f853a6395849d4782024a2b01e430
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
92
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Dropper.Mirai-7135893-0
Create hunting rule

Unix.Dropper.Mirai-7136105-0
Create hunting rule

Unix.Trojan.Mirai-7759336-0
Create hunting rule

Unix.Trojan.Mirai-7772538-0
Create hunting rule

Unix.Trojan.Mirai-9885259-0
Create hunting rule

Unix.Trojan.Mirai-9933849-0
Create hunting rule

Unix.Trojan.Mirai-9951089-0
Create hunting rule

Unix.Trojan.Mirai-10004218-0
Create hunting rule

Unix.Trojan.Gafgyt-6735924-0
Create hunting rule

Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ecddd4855e5ec5240c12d4linux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
99
Number of processes launched:
4
Processes remaning?
true
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16b8a61d-041a-4761-a1a7-8d8ab71b597a
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1654277
Signature
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654277 Sample: arm.elf Startdate: 02/04/2025 Architecture: LINUX Score: 56 11 daisy.ubuntu.com 2->11 13 Multi AV Scanner detection for submitted file 2->13 15 Yara detected Mirai 2->15 7 arm.elf 2->7         started        signatures3 process4 process5 9 arm.elf 7->9         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6/
Threat name:
Linux.Backdoor.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-04-02 06:37:19 UTC
File Type:
ELF32 Little (Exe)
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=efmu3s5bsierr5uwiuryozbs4wcpljzlibfgwncfg4au7ruu77ta._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access discovery
Link:
https://tria.ge/reports/250402-hdl29avrv3/
Behaviour
Reads runtime system information
Changes its process name
Reads process memory
Enumerates running processes
Renames itself
Contacts a large (28336) amount of remote hosts
Creates a large amount of network flows
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202503_elf_Mirai
Create hunting rule
Author:abuse.ch
Description:Detects Mirai 'TSource' ELF files
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:Linux_Generic_Threat_e9aef030
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 21594dcba1920918f6964523876432e584f5a72b404a6b344537014fc694ffe6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3469821/
  
Delivery method
Distributed via web download

Comments