MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c
SHA3-384 hash:	f4407e283580caae21a3fb9069218b158a5a164cd52632d20df8ff43024687ed379427e3194a27365c6fc6e61920de0c
SHA1 hash:	45419c6d38241d331d362b06f24e5adc38bc9953
MD5 hash:	1276396a5ac02e45538f5ceed54c8e69
humanhash:	ohio-maryland-july-quebec
File name:	arm5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	34'760 bytes
First seen:	2025-12-13 23:10:58 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:1XLq8n6b1Slbwfu2AIsuXnkk70t83BjJfdN5HRZO8s3UozI:1R6xSamSXnv7tVJ2zI
TLSH	T1DAF2E130D3FA39638BB190B6F1B80A40627205F1C4D63435AAF72B61F1CC5952AF46DB
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	34'760 bytes
File size (de-compressed) :	92'300 bytes
Format:	linux/arm
Unpacked file:	466a110a1565d3b3374e091259878f62750bce358dfefacf1f47c1a5cf4d2a49

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d3a4f7de-0f4a-4819-8993-85758e13a401/

Detection(s):

SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

packed upx

Link:

https://www.filescan.io/uploads/693df2911eac7b9b76a918de/reports/c2c5a794-4778-4543-9fb9-e01c36f199c2/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-12-13T21:18:00Z UTC

Last seen:

2025-12-14T00:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/bdcfc2b7-2e87-42c1-a205-d8928c10a551

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1577fcf3-da6b-4a16-bd43-fa0d2f5f47e1

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1832220

Signature

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-12-13 23:11:15 UTC

File Type:

ELF32 Little (Exe)

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=evxxqhlo4lzpgz522zofukjws55pwzsfrl2pirknwshwk6thy56a._file

Result

Malware family:

n/a

Score:

5/10

Tags:

upx

Link:

https://tria.ge/reports/251213-26fkqaymdk/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/48908faf-56d4-4f19-8551-143629215fcb

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research