MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b8413d98d4afaa76c6a33f0e0faf57eada9a99fec9809fca1f6eced2841b87f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	3b8413d98d4afaa76c6a33f0e0faf57eada9a99fec9809fca1f6eced2841b87f
SHA3-384 hash:	537a2323e01d78ca480e9bc64d705762ca57fff419c8c736641ef2f22fb70e344e009f1ee43e2c1e10a6a585e1356779
SHA1 hash:	ab37f48113827b29a3d579311eaa6c79392b7016
MD5 hash:	445e1aa204961c457d0c5a0136288c52
humanhash:	violet-glucose-princess-wisconsin
File name:	2.off3.ru
Download:	download sample
Signature	Mirai Create hunting rule
File size:	122'068 bytes
First seen:	2026-02-06 13:33:57 UTC
Last seen:	2026-02-06 14:41:32 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:bXz2Lxj2TNP9RxDjJ9nMw1XqsgIxSL7e686oR/w1tKG:32F2xXJ9f1+uH6oR/4tn
TLSH	T147C3124B4265B378CEB3E377909C08C5B471AD89E1895B8A50D8271BC9F799C2B3E703
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	122'068 bytes
File size (de-compressed) :	341'672 bytes
Format:	linux/amd64
Unpacked file:	5fbe57d352d0106bb7d1d22fca5ebeef08d6d6bffe19b2f61dc0f4427febbdef

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f4936369-cc83-4735-a96a-e5d76c14b19b/

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

packed upx

Link:

https://www.filescan.io/uploads/6985edd6981ff1d38a4b5225/reports/196b0a35-9bc2-46e5-a4b6-414e41fb3e81/overview

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/ae6deccc-250c-464a-8ad8-07608c4f5ac4

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a944e5be-5a9f-4a4b-ab68-d7d5bf278833

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1864733

Signature

Executes itself again with its parent PID as an argument (indicative of hampering debugging)

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/3b8413d98d4afaa76c6a33f0e0faf57eada9a99fec9809fca1f6eced2841b87f

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/3b8413d98d4afaa76c6a33f0e0faf57eada9a99fec9809fca1f6eced2841b87f/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hocbhwmnjl5ko3dkgpyob6xvp2w2tkm75smat7fb63wo2kcbxb7q._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery linux upx

Link:

https://tria.ge/reports/260206-qt7mwsfz8g/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research