MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c0acd93d242aef25754d37d25d39d986154824b9bd8655102baba8ab5ff70c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c0acd93d242aef25754d37d25d39d986154824b9bd8655102baba8ab5ff70c8
SHA3-384 hash:	c9c3a79d0047e41ec1122f9d86067d61ac77db46eabd68f683b1d242a8b5563cbd1474b92c4bf601ce2b6b47828d9af4
SHA1 hash:	c2169cd806eb079e2f41beff70cbb8e58f09d5e8
MD5 hash:	c5b5419183b6ae4c010651ebb33b2c18
humanhash:	purple-hot-minnesota-lion
File name:	armv5l
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	115'476 bytes
First seen:	2025-08-19 05:22:50 UTC
Last seen:	2025-08-19 07:14:51 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:CPY8Ggl3uezR4UU9cvLaZ+VY0/5uld1z4ekijlhg:CPBpRU6vLaZ+potz9kixhg
TLSH	T132B3299ABC409B16C6E42ABAFE1D51CD33130BF8E2EA3116DC155F2437CB95A0E7B641
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

34

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.ELF.Mirai-CQU.62511316.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sends data to a server

Creating a file

Receives data from a server

Connection attempt

DNS request

Runs as daemon

Substitutes an application name

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/774328be-0f01-4337-82e9-dca4c5e8adc0

Behavior Graph:

Download SVG

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce4ff818-2c73-4b6f-ab4e-6d4c391a8c63

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1759853

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2c0acd93d242aef25754d37d25d39d986154824b9bd8655102baba8ab5ff70c8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c0acd93d242aef25754d37d25d39d986154824b9bd8655102baba8ab5ff70c8/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-19 05:24:39 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fqfm3e6sikxpev2u2n6slu45tbqvjasltpmgkuicxk5ivnp7odea._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/250819-f5wdwsgn6x/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Changes its process name

Reads MAC address of network interface

Reads network interface configuration

Renames itself

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/252038e3-52ac-4b5b-b614-b184f7dc0353

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2c0acd93d242aef25754d37d25d39d986154824b9bd8655102baba8ab5ff70c8