MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7
SHA3-384 hash: 710b24f826711ddf549fb71f1ba52679d5d5139c216e97ce1a84d438a975e09cde98c3cfb620bc9d2194d27301eca5e2
SHA1 hash: 045ddf0561ae8101f523b956401ed08362ae66fc
MD5 hash: bd52bf835a5163deae59ac65ec01b096
humanhash: indigo-sink-nineteen-bakerloo
File name:sh4
Download: download sample
Signature Mirai
Create hunting rule
File size:663'584 bytes
First seen:2025-05-20 01:12:11 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 12288:1azTigX/srvn8vVW+L/o9xFDBih89P6bf6JAQplIOnSWDkkBrAb7:L6Ovn+z/m6+AYLgsrAb
TLSH T1A5E4BE53F3B0ADE7C04A4B75587FE2304716E2571782F381F2AE8604286B66AFE4E754
telfhash t1f1d097b20f6884015002ec1038c200bdae8ce9002fc4f840fe4cd8820c3002c2713d4b
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Linux.Gafgyt.15851.18127.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682bd6fac28c67d666422585linux22vpnfull_triage
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gcc lolbin remote
Link:
https://www.filescan.io/uploads/682bd6f81de1514c68745fde/reports/15366fb3-a363-455c-9176-060101100b89/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/15d3f08e-2072-4fa2-a681-d0ee5b54fe58
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1694417
Signature
Drops files in suspicious directories
Writes identical ELF files to multiple locations
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1694417 Sample: sh4.elf Startdate: 20/05/2025 Architecture: LINUX Score: 48 152 89.42.88.163, 1338, 35996 MOLDTELECOM-ASMoldtelecomAutonomousSystemMD Romania 2->152 154 109.202.202.202, 80 INIT7CH Switzerland 2->154 156 3 other IPs or domains 2->156 14 dash rm sh4.elf 2->14         started        16 dash rm 2->16         started        18 dash cut 2->18         started        20 7 other processes 2->20 process3 process4 22 sh4.elf 14->22         started        file5 148 /snap/bin/update, ELF 22->148 dropped 164 Writes identical ELF files to multiple locations 22->164 166 Drops files in suspicious directories 22->166 26 sh4.elf update 22->26         started        28 sh4.elf update 22->28         started        30 sh4.elf update 22->30         started        32 6 other processes 22->32 signatures6 process7 process8 34 update 26->34         started        38 update 28->38         started        40 update 30->40         started        42 update 32->42         started        44 update 32->44         started        46 update 32->46         started        48 3 other processes 32->48 file9 144 /usr/local/games/update, ELF 34->144 dropped 158 Drops files in suspicious directories 34->158 50 update update 34->50         started        52 update update 34->52         started        54 update update 34->54         started        58 5 other processes 34->58 160 Writes identical ELF files to multiple locations 38->160 60 3 other processes 38->60 62 7 other processes 40->62 64 6 other processes 42->64 56 update update 44->56         started        66 2 other processes 46->66 signatures10 process11 process12 68 update 50->68         started        72 update 52->72         started        74 update 54->74         started        76 update 56->76         started        78 update 58->78         started        80 update 58->80         started        82 update 60->82         started        84 update 60->84         started        file13 146 /usr/games/update, ELF 68->146 dropped 162 Drops files in suspicious directories 68->162 86 update update 68->86         started        88 update update 68->88         started        90 update update 68->90         started        96 4 other processes 68->96 98 6 other processes 72->98 92 update update 74->92         started        100 2 other processes 74->100 94 update update 78->94         started        102 2 other processes 80->102 signatures14 process15 process16 104 update 86->104         started        108 update 88->108         started        110 update 90->110         started        112 update 92->112         started        114 update 94->114         started        116 update 96->116         started        118 update 96->118         started        120 update 96->120         started        122 update 98->122         started        file17 150 /usr/bin/update, ELF 104->150 dropped 168 Drops files in suspicious directories 104->168 124 update update 104->124         started        126 update update 104->126         started        128 update update 104->128         started        138 3 other processes 104->138 130 update update 108->130         started        132 update update 108->132         started        134 update update 108->134         started        136 update update 110->136         started        140 2 other processes 116->140 signatures18 process19 process20 142 update 138->142         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-05-20 01:13:19 UTC
File Type:
ELF32 Little (Exe)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fubycwnk5ap47k6pc3ufaz2dff55twjkouhb3k5yt4rkibomz23q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/250520-bkmh2ahp3t/
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4f3f5655-c8e1-471d-9cb6-e5f5fe97ba6e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:malwareelf55503
Create hunting rule
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 2d038159aae81fcfabcf16e8506743297bd9d92a750e1dabb89f22a405ccceb7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3545665/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments