MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cd4f5f2c8b136e26eb3c4da49c1b7da134947e5a2e3e0b6e6d7645791f68111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cd4f5f2c8b136e26eb3c4da49c1b7da134947e5a2e3e0b6e6d7645791f68111
SHA3-384 hash: 6550fab231a82a3feec9e8d908296f3018417f54d45bbebef30c786b9f502ac24b2b7190cf26e6840349ebee6c4ebdb2
SHA1 hash: 8e2bd8a28d25bfd92581cd4c56ea5b08ef6a097b
MD5 hash: 65fa173ec9c8a7fef9c488ddef0ef75c
humanhash: gee-chicken-violet-william
File name:xnxnxnxnxnxnxnxnm68kxnxn
Download: download sample
Signature Mirai
Create hunting rule
File size:106'936 bytes
First seen:2025-12-24 15:33:26 UTC
Last seen:2025-12-24 17:19:44 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:pIamHCT0JuAB4ZcxKuaafMsnHi+gXvkKjGb1pOVDF9ylYb8rSF:pIaaxJuo4ZAKzAHi7kK5DF/USF
TLSH T1AAA3B087A550BEEFE0985E7FC453CD29FF20CFA05A831B25A0B9F5805E393947692D42
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
89
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/694c07fce126b9ff4390119c/reports/1612fe6c-e3ac-425e-adb2-0a0ea08edaff/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5558b4a8-4cc3-4b4b-bbfe-8f37dd21762f
Behavior Graph:
Download SVG
%3 guuid=59f5ff2a-1a00-0000-573d-8f66c40a0000 pid=2756 /usr/bin/sudo guuid=4daae52d-1a00-0000-573d-8f66ca0a0000 pid=2762 /tmp/sample.bin guuid=59f5ff2a-1a00-0000-573d-8f66c40a0000 pid=2756->guuid=4daae52d-1a00-0000-573d-8f66ca0a0000 pid=2762 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e67eb6c1-b6ca-4d5e-b651-ba9b2dc5efe7
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1838915
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2cd4f5f2c8b136e26eb3c4da49c1b7da134947e5a2e3e0b6e6d7645791f68111
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2cd4f5f2c8b136e26eb3c4da49c1b7da134947e5a2e3e0b6e6d7645791f68111/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Suspicious
First seen:
2025-12-24 13:38:25 UTC
File Type:
ELF32 Big (Exe)
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftkpl4wiwe3oe3vtytnetqnx3ijusr7fulr6bnxg25sfpepwqeiq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251224-szjjcsfz8d/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f5cf8051-9741-4ebf-b380-6fa875d7912e
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 2cd4f5f2c8b136e26eb3c4da49c1b7da134947e5a2e3e0b6e6d7645791f68111

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3742503/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3742496/

Comments