🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896
SHA3-384 hash: 13397ffe12c63633dfaa2479b90c1b39c2f136c97771e7721ce572be4717bd03616bed46959cdd15cad1be3a91163a02
SHA1 hash: 35af385cffe7ec6aabf18aa418e1dc46ff881a52
MD5 hash: d2c2a956767da1f91f78557a53707381
humanhash: xray-moon-eleven-kitten
File name:arm7_f.65fb47
Download: download sample
Signature Mirai
Create hunting rule
File size:831'012 bytes
First seen:2026-11-01 17:33:27 UTC
Last seen:2026-11-01 18:23:07 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:Fj8VoAE7Z8W+I7EdtLZVl1a9UFErwv737gBd19hfiXehHJtNs+KBPq8pLHSj+:FGwj+I7Ejl1a9UWe7LgBd1bfEEnY/S
TLSH T127053855F8809F61C6C529B6F75D82AC73070BB9D3EB71068A255B3437EB86B0F3A601
telfhash t10ef09e06cb0004d915d086bca7b7e723527515ce8f0e7cba82a49e6e5802ec03e5c972
Magika elf
Reporter BlinkzSec
Tags:mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.32133.LX.BOT.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Gathering data
Verdict:
Unknown
File Type:
elf.32.le
Link:
https://opentip.kaspersky.com/21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/04f3e543-10ef-4298-a3e8-2553124baf99
Behavior Graph:
Download SVG
%3 guuid=26c51f49-1b00-0000-41f4-a1cff1080000 pid=2289 /usr/bin/sudo guuid=1dd9e94c-1b00-0000-41f4-a1cff8080000 pid=2296 /tmp/sample.bin guuid=26c51f49-1b00-0000-41f4-a1cff1080000 pid=2289->guuid=1dd9e94c-1b00-0000-41f4-a1cff8080000 pid=2296 execve
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b3add06f-1124-4bb0-b839-c9c1436ef9e5
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1996318
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops files in suspicious directories
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Sample contains AV-related strings
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to set files in /etc globally writable
Tries to open /proc/mtd (commonly found in embedded devices)
Writes ELF files to hidden directories
Writes identical ELF files to multiple locations
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1996318 Sample: arm7_f.65fb47.elf Startdate: 01/11/2026 Architecture: LINUX Score: 100 144 45.135.194.96, 9091 PFCLOUDPfcloudUGDE Germany 2->144 146 91.189.91.99, 443 CANONICAL-ASGB United Kingdom 2->146 148 Antivirus detection for dropped file 2->148 150 Antivirus / Scanner detection for submitted sample 2->150 152 Multi AV Scanner detection for submitted file 2->152 154 Sample contains AV-related strings 2->154 12 arm7_f.65fb47.elf 2->12         started        16 systemd bot 2->16         started        18 gnome-session-binary sh gsd-rfkill 2->18         started        20 21 other processes 2->20 signatures3 process4 file5 132 /etc/profile.d/.syscache.sh.tmp, ASCII 12->132 dropped 134 /etc/cron.d/.syscache.tmp, ASCII 12->134 dropped 174 Sample tries to set files in /etc globally writable 12->174 176 Writes ELF files to hidden directories 12->176 178 Opens /sys/class/net/* files useful for querying network interface information 12->178 186 3 other signatures 12->186 22 arm7_f.65fb47.elf bot 12->22         started        26 arm7_f.65fb47.elf bot 12->26         started        28 arm7_f.65fb47.elf arm7_f.65fb47.elf 12->28         started        36 4 other processes 12->36 136 /var/lib/.syscache/bot.new, ELF 16->136 dropped 138 /tmp/.syscache/bot.new, ELF 16->138 dropped 140 /root/.cache/.syscache/bot.new, ELF 16->140 dropped 142 5 other malicious files 16->142 dropped 180 Sample tries to persist itself using /etc/profile 16->180 182 Drops files in suspicious directories 16->182 184 Sample reads /proc/mounts (often used for finding a writable filesystem) 16->184 30 bot sh 16->30         started        32 bot 16->32         started        34 bot 16->34         started        38 3 other processes 16->38 signatures6 process7 file8 122 /var/lib/.syscache/bot, data 22->122 dropped 124 /tmp/.syscache/bot, data 22->124 dropped 126 /root/.cache/.syscache/bot, data 22->126 dropped 128 /dev/shm/.syscache/bot, data 22->128 dropped 156 Sample tries to set files in /etc globally writable 22->156 158 Writes ELF files to hidden directories 22->158 160 Opens /sys/class/net/* files useful for querying network interface information 22->160 48 6 other processes 22->48 130 /dev/shm/.syscache/bot.new (deleted), data 26->130 dropped 162 Writes identical ELF files to multiple locations 26->162 164 Sample tries to persist itself using /etc/profile 26->164 166 Drops files in suspicious directories 26->166 40 bot sh 26->40         started        50 5 other processes 26->50 168 Tries to open /proc/mtd (commonly found in embedded devices) 28->168 170 Sample reads /proc/mounts (often used for finding a writable filesystem) 28->170 172 Sample tries to persist itself using cron 28->172 42 arm7_f.65fb47.elf sh 28->42         started        52 5 other processes 28->52 54 3 other processes 30->54 44 bot sh 36->44         started        46 bot sh 36->46         started        56 13 other processes 36->56 signatures9 process10 process11 66 3 other processes 40->66 58 sh systemctl 42->58         started        68 2 other processes 42->68 60 sh systemctl 44->60         started        70 2 other processes 44->70 72 3 other processes 46->72 74 3 other processes 48->74 62 systemctl systemd-sysv-install 54->62         started        64 systemctl systemd-sysv-install 56->64         started        process12 76 systemctl systemd-sysv-install 58->76         started        78 systemctl systemd-sysv-install 60->78         started        80 systemd-sysv-install update-rc.d 62->80         started        90 2 other processes 62->90 82 systemd-sysv-install update-rc.d 64->82         started        92 2 other processes 64->92 84 systemctl systemd-sysv-install 66->84         started        86 systemctl systemd-sysv-install 72->86         started        88 systemctl systemd-sysv-install 74->88         started        process13 94 systemd-sysv-install update-rc.d 76->94         started        102 2 other processes 76->102 96 systemd-sysv-install update-rc.d 78->96         started        104 2 other processes 78->104 98 update-rc.d systemctl 80->98         started        100 update-rc.d systemctl 82->100         started        106 3 other processes 84->106 108 3 other processes 86->108 110 3 other processes 88->110 process14 112 update-rc.d systemctl 94->112         started        114 update-rc.d systemctl 96->114         started        116 update-rc.d systemctl 106->116         started        118 update-rc.d systemctl 108->118         started        120 update-rc.d systemctl 110->120         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 17:32:39 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=efucv7ycbcgodm75kfbflkk7nubq2kzvtkobqm5pkwyhvppqtcla._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
antivm defense_evasion discovery
Link:
https://tria.ge/reports/261101-v5k1gswzfv/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Checks hardware identifiers (DMI)
Enumerates running processes
Reads MAC address of network interface
Reads network interface configuration
Malware Family:
mirai
Create hunting rule
Malicious:
True
Tags:
detect-debug-environment sets-process-name elf persistence arm checks-cpu-name
Link:
https://intel.virussign.com/intelligence/file/21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:LIN_Malware_Unknown_ForgeAuto_0daebbb8
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (elf, etat binaire)
Rule name:malwareelf55503
Create hunting rule
Rule name:MIRAI_OHSHIT_payload
Create hunting rule
Author:AfterPacket
Description:MIRAI_OHSHIT ELF payload -- compiled-in C2 set, all architectures
Reference:https://github.com/Afterpacket/drosera-threat-intel
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 21682aff02088ce1b3fd514255a95f6d030d2b359a9c1833af55b07abdf09896

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4050026/
  
Delivery method
Distributed via web download

Comments