MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4
SHA3-384 hash: b4eb817a3a34fd01de093402507d55b85ff4fe847b499d583b77f7cdbbee0719f51a36f90c6a286fdc901b96ce83375a
SHA1 hash: 8f7f5b9904d4a7545ddf00d974c9543dc3e7151f
MD5 hash: 593771183b9bf7375baf9c373a912f4a
humanhash: december-tennessee-hotel-tennessee
File name:sshd
Download: download sample
Signature Mirai
Create hunting rule
File size:123'816 bytes
First seen:2025-07-18 00:18:23 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:dVBxC7HIzPIPFJwDkDTuQKaxM6rq5yRaBCdhb+MRgt8TmbSvD4bGeFx4m1WHZa:dVkVTVKT6e5yRaBCyzt8weD4nxVUHZa
TLSH T199C3C64E7F219FBEF6ACC63447B74A20975923D623E186C5D2ACD9141F6028E241FFA4
telfhash t188219f58597823e097751c591aedff76d1a130df56252e278f01edadaabdd828e00c0c
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
23
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-8041698-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Receives data from a server
Runs as daemon
Opens a port
Kills processes
Sends data to a server
Connection attempt
Substitutes an application name
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin obfuscated obfuscated remote
Link:
https://www.filescan.io/uploads/6879930719132d9848825218/reports/7c0b415e-650b-43dd-981c-438fc6ec10ab/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
94
Number of processes launched:
13
Processes remaning?
true
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/979d0608-874a-48fe-98d7-57ebe538f673
Behavior Graph:
Download SVG
%3 guuid=a6045ae3-1a00-0000-f050-0c1986080000 pid=2182 /usr/bin/sudo guuid=2bad5ae5-1a00-0000-f050-0c198f080000 pid=2191 /tmp/sample.bin guuid=a6045ae3-1a00-0000-f050-0c1986080000 pid=2182->guuid=2bad5ae5-1a00-0000-f050-0c198f080000 pid=2191 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0ebbbbbd-4886-4bff-bee9-d499c458f385
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1739278
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Terminates several processes with shell command 'killall'
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1739278 Sample: sshd.elf Startdate: 18/07/2025 Architecture: LINUX Score: 60 46 143.109.222.184 WISCNET1-ASUS United States 2->46 48 66.19.208.129 WINDSTREAMUS United States 2->48 50 99 other IPs or domains 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 9 sshd.elf 2->9         started        11 xfce4-session xfwm4 2->11         started        13 xfce4-session xfwm4 2->13         started        15 14 other processes 2->15 signatures3 process4 process5 17 sshd.elf 9->17         started        19 sshd.elf 9->19         started        21 sshd.elf 9->21         started        process6 23 sshd.elf sh 17->23         started        25 sshd.elf sh 17->25         started        27 sshd.elf sh 17->27         started        29 71 other processes 17->29 process7 31 sh killall 23->31         started        34 sh killall 25->34         started        36 sh killall 27->36         started        38 sh killall 29->38         started        40 sh killall 29->40         started        42 sh killall 29->42         started        44 68 other processes 29->44 signatures8 56 Terminates several processes with shell command 'killall' 31->56
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4/
Verdict:
Malicious
Threat:
Linux.Backdoor.Gafgyt
Link:
https://tip.neiki.dev/file/2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4
Threat name:
Linux.Backdoor.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-07-18 00:19:16 UTC
File Type:
ELF32 Big (Exe)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fscld3z4ypq5qdd5vx5kcjt2aaagpbrogynatnir44kszfajlxka._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:kyton defense_evasion discovery
Link:
https://tria.ge/reports/250718-al88ratlv2/
Behaviour
Reads runtime system information
Changes its process name
Reads CPU attributes
Enumerates running processes
Writes file to system bin folder
Modifies Watchdog functionality
Contacts a large (148412) amount of remote hosts
Creates a large amount of network flows
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-8041698-0
YARA:
n/a
Link:
https://app.threat.zone/submission/9c63757c-4f18-4b34-9615-b2be780227e1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 2c84b1ef3cc3e1d80c7dadfaa1267a000067862e361a09b511e7152c94095dd4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3576541/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3584470/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments