MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609
SHA3-384 hash: ee958f27705d44f61e15734ef6780cfcbed23b8540ef363c169f199924339269d177083acebee7c61c46e9318f19bc6c
SHA1 hash: e543fb4ffe3e465990f9e9176244ca46ade74e6e
MD5 hash: 6f170e25813351c1dd1dfa7a59d538b2
humanhash: october-sixteen-maryland-nuts
File name:iran.x86_64
Download: download sample
Signature Mirai
Create hunting rule
File size:47'776 bytes
First seen:2026-02-25 06:31:18 UTC
Last seen:2026-02-25 07:21:32 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:/CYlu1gzShvupCJk8hRIE3kpNwWa0xeKyxEy2e0bDG44:/cSzSxupEl3kpNTxe32THE
TLSH T1F823F2C3A6BFEDE9CDF6893D1D2B95D8BA1185193B0B0BDB01AF11E87D245C23E12950
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :47'776 bytes
File size (de-compressed) :123'464 bytes
Format:linux/amd64
Unpacked file: e08aacd394091643252d6d17d55caf86155edc34409d638ed149f63f4beec148

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9a656ec8-0f4a-4a85-ba2a-e94f6c168d26/
Detection(s):
SecuriteInfo.com.Linux.DDoS.2637.6288.4255.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
Substitutes an application name
Deleting of the original file
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
44
Number of processes launched:
3
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.64.le
Link:
https://opentip.kaspersky.com/2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1a1b9157-6bf0-4f93-81ad-ba89c5889ae2
Behavior Graph:
Download SVG
%3 guuid=081c87f8-1b00-0000-37c9-ec58120c0000 pid=3090 /usr/bin/sudo guuid=76ebaefb-1b00-0000-37c9-ec58160c0000 pid=3094 /tmp/sample.bin mprotect-exec guuid=081c87f8-1b00-0000-37c9-ec58120c0000 pid=3090->guuid=76ebaefb-1b00-0000-37c9-ec58160c0000 pid=3094 execve guuid=c30a19fe-1b00-0000-37c9-ec58180c0000 pid=3096 /tmp/sample.bin zombie guuid=76ebaefb-1b00-0000-37c9-ec58160c0000 pid=3094->guuid=c30a19fe-1b00-0000-37c9-ec58180c0000 pid=3096 clone guuid=970732fe-1b00-0000-37c9-ec58190c0000 pid=3097 /tmp/sample.bin delete-file net send-data zombie guuid=c30a19fe-1b00-0000-37c9-ec58180c0000 pid=3096->guuid=970732fe-1b00-0000-37c9-ec58190c0000 pid=3097 clone c1d30aec-c2bf-5986-a54f-223c1f729707 134.199.219.57:6060 guuid=970732fe-1b00-0000-37c9-ec58190c0000 pid=3097->c1d30aec-c2bf-5986-a54f-223c1f729707 send: 415B
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/736bf600-5904-476e-b641-ccfce81984f3
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-02-25 06:32:31 UTC
File Type:
ELF64 Little (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnacg75cndoyd3ce4ehrqxiq3i2e2eln3dswnw5rr3dbufkzayeq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery linux upx
Link:
https://tria.ge/reports/260225-haaj2sex3e/
Behaviour
Reads runtime system information
Changes its process name
Enumerates running processes
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 857a7bd53687d574906c513adbcff9fecb1269a69756446327e6cee07980e817

Mirai

elf 2b40237fa268dd81ec44e10f185d10da344d116dd8e566dbb18ec61a15590609

(this sample)

Mirai

elf e08aacd394091643252d6d17d55caf86155edc34409d638ed149f63f4beec148

  
URLhaus
https://urlhaus.abuse.ch/url/3785321/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 e08aacd394091643252d6d17d55caf86155edc34409d638ed149f63f4beec148
  
Dropping
MD5 cd858ef9299eae60dde1e0965f74bf06
  
Dropped by
SHA256 857a7bd53687d574906c513adbcff9fecb1269a69756446327e6cee07980e817
  
Dropped by
MD5 2b1931ca78a0c1832deb0d154fbd17a1
  
URLhaus
https://urlhaus.abuse.ch/url/3785310/

Comments