MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11
SHA3-384 hash: 31e0c0c04c2514d225aa56fa65d7807ad49018d441d98fffa129b83502d3f6607632bde8294a3cb40783c770b50160cb
SHA1 hash: 4fb3f20d11f294f5e56cf02dfd553c55d449005a
MD5 hash: f6315855cd8b3809d7b6b1639993c0ca
humanhash: vegan-moon-texas-twelve
File name:sumrak.x86_64
Download: download sample
Signature Mirai
Create hunting rule
File size:53'652 bytes
First seen:2026-01-16 02:27:33 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:ZNNaa+fghBssKqKs3sr30a0Ehg1Kyyy5uj1US661D/K:ZNl8ghBtEscr301No5UKK
TLSH T1B133F12AD38166FFF856D5B74AAC7449DE71B242295647668EB3E0F80CF9C81B8341C3
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :53'652 bytes
File size (de-compressed) :138'248 bytes
Format:linux/amd64
Unpacked file: a78c0ce21eb28ff360a6c2f029151e17c664685c6aa1014c6b380f452bd61223

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/75fee538-ff60-49c7-9300-7816da8d71f2/
Detection(s):
SecuriteInfo.com.Linux.Mirai-19.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gafgyt mirai packed upx
Link:
https://www.filescan.io/uploads/6969a23d3dd9d20950567507/reports/f2ff6d87-bf9b-4ba0-b8e1-cd097b6c797b/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2026-01-15T21:51:00Z UTC
Last seen:
2026-01-15T22:18:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Gafgyt.bl HEUR:Backdoor.Linux.Gafgyt.bj HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b
Link:
https://opentip.kaspersky.com/24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a89c40a8-d430-42cc-8115-fc9b676707b1
Behavior Graph:
Download SVG
%3 guuid=a3a630cd-1900-0000-dac0-28a6b0090000 pid=2480 /usr/bin/sudo guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486 /tmp/sample.bin mprotect-exec net guuid=a3a630cd-1900-0000-dac0-28a6b0090000 pid=2480->guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=51b71fd1-1900-0000-dac0-28a6b9090000 pid=2489 /tmp/sample.bin guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486->guuid=51b71fd1-1900-0000-dac0-28a6b9090000 pid=2489 clone guuid=80e52ad1-1900-0000-dac0-28a6ba090000 pid=2490 /tmp/sample.bin guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486->guuid=80e52ad1-1900-0000-dac0-28a6ba090000 pid=2490 clone guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491 /tmp/sample.bin net send-data zombie guuid=af9574cf-1900-0000-dac0-28a6b6090000 pid=2486->guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491 clone guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con ff18ffb3-2a60-5dd8-95ab-de107a9af169 91.92.240.251:1997 guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491->ff18ffb3-2a60-5dd8-95ab-de107a9af169 send: 315B guuid=6af64bd1-1900-0000-dac0-28a6bc090000 pid=2492 /tmp/sample.bin guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491->guuid=6af64bd1-1900-0000-dac0-28a6bc090000 pid=2492 clone guuid=ec1650d1-1900-0000-dac0-28a6bd090000 pid=2493 /tmp/sample.bin guuid=1c9537d1-1900-0000-dac0-28a6bb090000 pid=2491->guuid=ec1650d1-1900-0000-dac0-28a6bd090000 pid=2493 clone
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/88d193d3-be8e-4946-8280-73d2a91bea80
Result
Threat name:
Gafgyt
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1851804
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Gafgyt
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-16 00:48:32 UTC
File Type:
ELF64 Little (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=etrfmurl7arnt4aabr7fcn4u4o7wx2lzly5xfdv7qc7eiblzjiiq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:owari botnet linux upx
Link:
https://tria.ge/reports/260116-cx1f4avlck/
Behaviour
Mirai
Mirai family
Malware Config
C2 Extraction:
sumrak2026.duckdns.org
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0a7ec3bd-ee2d-4f46-af02-93aac588d190
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 24e256522bf822d9f0000c7e513794e3bf6be9795e3b728ebf80be4405794a11

(this sample)

Mirai

elf a78c0ce21eb28ff360a6c2f029151e17c664685c6aa1014c6b380f452bd61223

  
URLhaus
https://urlhaus.abuse.ch/url/3758544/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 a78c0ce21eb28ff360a6c2f029151e17c664685c6aa1014c6b380f452bd61223
  
Dropping
MD5 fa2ec8d350d340c34de4087101733700

Comments