MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b
SHA3-384 hash:	75295b0a3cfc08e49a751be82218cca5ef2abffc43f98b10a858b6e22b67c4a4049e96f7fa65c417d9ac2486ba0fd64d
SHA1 hash:	97fb07f1d730a28e6a91b5e46d40804f471e519c
MD5 hash:	7610fcabbf8080151461728dbb25add9
humanhash:	quebec-pennsylvania-five-chicken
File name:	xnxnxnxnxnxnxnxnpowerpcxnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	197'352 bytes
First seen:	2025-12-07 17:20:24 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:zez0YQpRtRpFtAscSmPW3iOEs2sHV2se0eRZEsNkYFtCSUaO:aQ3RwSmeSfsTHV2HxKYrOX
TLSH	T146146A16FB0C0463CA931CF04E3F4BF9A3621A9104F99111650C7F5A6A76D77A28BFE9
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 9f38218a5f5f1f12cf6b46cf32a5ebca3dcf7d2f216713e4bb6e67d49b37db49

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	68'388 bytes
File size (de-compressed) :	197'352 bytes
Format:	linux/ppc32
Packed file:	9f38218a5f5f1f12cf6b46cf32a5ebca3dcf7d2f216713e4bb6e67d49b37db49

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Runs as daemon

Creating a file in the %temp% directory

Receives data from a server

Kills processes

Locks files

Sends data to a server

Substitutes an application name

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-12-07T15:41:00Z UTC

Last seen:

2025-12-07T21:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/801dbb8e-afaf-4ff4-987c-8094c38f2e96

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1828476

Signature

Connects to many ports of the same IP (likely port scanning)

Deletes system log files

Manipulation of devices in /dev

Sample tries to kill a massive number of system processes

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-12-07 17:21:15 UTC

File Type:

ELF32 Big (Exe)

AV detection:

2 of 36 (5.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gqjmff6v5t5qiwvnyv4set2v3vhjes43tsfvgd75xk5ev45flsnq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251207-vw3tyasmej/

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f3c8273f-1eb8-4443-ad27-6ac8b2c309b7

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3412c297d5ecfb045aadc579224f55dd4e924b9b9c8b530ffdbaba4af3a55c9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.