MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 9 File information Comments

SHA256 hash:	298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac
SHA3-384 hash:	3ba40dd8b5d81b85478ded00a56c10274b2ac740b97851fb6e52bcecb4e45d417f07b898d623de5264aab2dff26188d6
SHA1 hash:	5a54c0756d23f2f2977751b7cc362dd4d88027af
MD5 hash:	cca4a72befbb46c370d7a8b675027e2d
humanhash:	pip-cold-winter-happy
File name:	android-arm
Download:	download sample
Signature	Mirai Create hunting rule
File size:	108'916 bytes
First seen:	2026-10-05 16:48:48 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	3072:P0GrvkrWqB1Cjxs1UBwzquSBJgK7ybeA8JhL6skG:P0GrvuDB1AwUBwzquSRGbPghBN
TLSH	T1FAB3079AB8D2D453C4E45E75F82D82CC33673BBDD2DA3202DD04EF2429DE48D4E29695
telfhash	t172f02744b97a869e99e39e74dcac06e18407a12720664b21df05dfe4843e455f21cd0f
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 22734a0b2e3cf2be18cb05d6fdacd6f87b80fb61481197de560bd3f573257f81

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	57'080 bytes
File size (de-compressed) :	108'916 bytes
Format:	linux/arm
Packed file:	22734a0b2e3cf2be18cb05d6fdacd6f87b80fb61481197de560bd3f573257f81

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Gathering data

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-10-05T15:08:00Z UTC

Last seen:

2026-10-06T20:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c8b6a3f8-9f1c-4966-ad46-9c2dcd6d26ae

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/11982956-502b-44a8-9f54-cbba350a80b0

Score:

99%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2026-10-05 16:38:51 UTC

File Type:

ELF32 Little (SO)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fgh4tqneu2gy5ijx6bvm4tibu7nekc2b5r7yknbyx7nf4ftrsgwa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/261005-vbwvwszygy/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	deepfield_qtxbot_mirai_xor_table Create hunting rule
Author:	Nokia Deepfield ERT
Description:	morte/Kurayami-lineage Mirai fork table: qtxbot and GhostWuzHere666 XOR-0x22 encoded

Rule name:	elf_arm_mips_ko_so Create hunting rule

Rule name:	ELF_Packer_Dropper_Fileless_Armhf Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects obfuscated Linux ELF packers/droppers featuring ChaCha20/RC4 decryption, memfd_create/execveat fileless execution capabilities, and unique binary artifacts.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	Mirai_Botnet_Malware Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	Mirai_Botnet_Malware_RID2EF6 Create hunting rule
Author:	Florian Roth
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	NSVPS_Hydra_SSH_Bruteforce Create hunting rule
Author:	sanad (NSVPS-SOC)
Description:	Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot