MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569
SHA3-384 hash:	445b1a92053500eec7eec0998c9c56ee1c224b3f1ad0e25d335b926cb3eef06267d1228dcb00fc2b07591644be76ffdb
SHA1 hash:	b9f126a6bda82a74a9a843463921e05035406b15
MD5 hash:	da06d47aca7b6bf969e7ccace0ac2896
humanhash:	happy-fourteen-two-juliet
File name:	Josho.ppc
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	51'332 bytes
First seen:	2025-05-16 16:29:40 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdy4q:k6HAt1ezbnAXZUBt33tbC/3XwBq
TLSH	T15D332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695EEA458136F335586F8D
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Dropper.Mirai-7135890-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135939-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135957-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7136025-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9940367-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682769bd4a59e5a2ce054647linux22vpnfull_triage

Tags:

mirai

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sends data to a server

Receives data from a server

Runs as daemon

Substitutes an application name

Performs a bruteforce attack in the network

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/68276866bff72ff46b6541d6/reports/888daf9f-0232-432e-ba63-9b9cf5ceddaf/overview

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/33d3d75e-c3cd-40fc-bcea-08a331bd09d0

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1692217

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-16 16:32:09 UTC

File Type:

ELF32 Big (Exe)

AV detection:

27 of 37 (72.97%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eg2u5twmsilakwmtfzmj4tyyhdls6flt5yedtjkgg6ht4u4dcvuq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:josho linux

Link:

https://tria.ge/reports/250516-t1m4lscn5z/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135890-0

YARA:

n/a

Link:

https://app.threat.zone/submission/b83b1ecf-3759-4c89-9b05-7960d155d1c9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/21b54ececc92160559932e589e4f1838d72f1573ee0839a546378f3e53831569