MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4
SHA3-384 hash: 2d04e36b0c5c58a3daa9ba0b55d16a15200ce78e850004bb7b1552b79b65bfa8cd8c55606f8856cfbd42e5d8f083b8f7
SHA1 hash: 74b5314d0ed285fd82a2bc09138e76016151fb70
MD5 hash: 9e1b7bb925e7152f964804a1f52ed22d
humanhash: mirror-island-video-delaware
File name:kitty.i686
Download: download sample
Signature Mirai
Create hunting rule
File size:63'000 bytes
First seen:2025-08-17 09:15:09 UTC
Last seen:2025-08-19 12:22:29 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 1536:7CK464XjxQ06g8ZCp7pxGyDUaHglR3EVZNI0cJXBs7DgagKxmgor:7CKZ29Q0MyDUaA7UVX/sG70ag+c
TLSH T19E536C84F39BC1F1F58346B00067D37BAB39ED294014D659FB4A373AADB27528A4B25C
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
4
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.10074.11863.19649.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Receives data from a server
DNS request
Runs as daemon
Sends data to a server
Connection attempt
Substitutes an application name
Deleting of the original file
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/58b648d8-3cbc-4eda-811e-6de56275fa22
Behavior Graph:
Download SVG
%3 guuid=ff2c4fa8-1f00-0000-cdc9-8248640b0000 pid=2916 /usr/bin/sudo guuid=3bde6eac-1f00-0000-cdc9-82486b0b0000 pid=2923 /tmp/sample.bin guuid=ff2c4fa8-1f00-0000-cdc9-8248640b0000 pid=2916->guuid=3bde6eac-1f00-0000-cdc9-82486b0b0000 pid=2923 execve guuid=59bda9ac-1f00-0000-cdc9-82486c0b0000 pid=2924 /tmp/sample.bin guuid=3bde6eac-1f00-0000-cdc9-82486b0b0000 pid=2923->guuid=59bda9ac-1f00-0000-cdc9-82486c0b0000 pid=2924 clone guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925 /tmp/sample.bin delete-file net send-data zombie guuid=59bda9ac-1f00-0000-cdc9-82486c0b0000 pid=2924->guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925 clone eb9dca7b-d301-522e-83c7-8d6f291efc38 66.78.40.221:9080 guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925->eb9dca7b-d301-522e-83c7-8d6f291efc38 send: 60B 6a6ce952-23cd-5c51-b461-6ca6a8c64225 1.0.0.1:53 guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925->6a6ce952-23cd-5c51-b461-6ca6a8c64225 send: 40B ac570862-0b5b-558b-b43c-fb15134a62c4 114.114.114.114:53 guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925->ac570862-0b5b-558b-b43c-fb15134a62c4 send: 40B guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2926 /tmp/sample.bin zombie guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2925->guuid=a61cb7ac-1f00-0000-cdc9-82486d0b0000 pid=2926 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6af4d374-251d-409f-88ee-1f93a59c2865
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1758776
Signature
Multi AV Scanner detection for submitted file
Sample deletes itself
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1758776 Sample: kitty.i686.elf Startdate: 17/08/2025 Architecture: LINUX Score: 52 17 169.254.169.254, 80 USDOSUS Reserved 2->17 19 noname-3d45fa2f.online 2->19 21 daisy.ubuntu.com 2->21 23 Multi AV Scanner detection for submitted file 2->23 8 kitty.i686.elf 2->8         started        10 python3.8 dpkg 2->10         started        signatures3 process4 process5 12 kitty.i686.elf 8->12         started        process6 14 kitty.i686.elf 12->14         started        signatures7 25 Sample deletes itself 14->25
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-08-16 07:19:00 UTC
File Type:
ELF32 Little (SO)
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=elqnu2icddhct3gtulqatnfucmrbhj4otlcv35asisp5zf2hgdca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery linux
Link:
https://tria.ge/reports/250817-k9fapatlz9/
Behaviour
Reads runtime system information
Changes its process name
Enumerates running processes
Deletes itself
Unexpected DNS network traffic destination
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/19c48545-7d50-42ff-a8fc-54d94bb32eb6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 22e0da690218ce29ecd3a2e009b4b4132213a78e9ac55df412449fdc974730c4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3605246/
  
Delivery method
Distributed via web download

Comments