MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c
SHA3-384 hash:	6598dfd96d940a476e1f0f5fe2505ca9dff6a3c101b96e7da094db23dd02e40aad80fe8e514670e0a61f4d9ebbfb1043
SHA1 hash:	341f2a2a5cdb05ba7972a19061184bc1fb5daa84
MD5 hash:	df11ff201416700699973469c346e680
humanhash:	gee-orange-uniform-double
File name:	zermips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	63'772 bytes
First seen:	2025-12-05 18:24:01 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:JwpesUa+1nZYKXqMyERPiRExPP8nPiZnPPUDpe0wqqud:SzUasnZYqbqE0hqud
TLSH	T1A453B61A1E269FACF768873657B78F31968833D326E1D741D15CEA011EA034E741FBA8
telfhash	t1cd016d48453823f067452dada7eeff76d55101ef45166e738e00fa6a9b21a46ae0092c
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69332363bba50eaf042369c4/reports/748c0b1b-0070-470d-9931-eb9704e45db2/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-12-05T16:21:00Z UTC

Last seen:

2025-12-06T03:57:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Linux.Mirai.gen

Link:

https://opentip.kaspersky.com/2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1fde4bb5-0784-44a0-b99c-929e67b0ddbb

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1827627

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c/

Verdict:

Malicious

Threat:

Backdoor.Linux.Mirai

Link:

https://tip.neiki.dev/file/2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-12-05 18:28:21 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 36 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fzkr7ykgkyo5vcpwlnd4dz46p232lkm4vcej27n75xszfasqvzwa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/251205-w4mclah14a/

Behaviour

System Network Configuration Discovery

Changes its process name

Renames itself

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-9885259-0

YARA:

n/a

Link:

https://app.threat.zone/submission/642f2d5f-a163-44d9-818c-9fa8584001e3

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.