MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bff12a909416b7ecdc2049f4fbcc359e8eb7647db5f5561247ac0eb4a5d7836. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	3bff12a909416b7ecdc2049f4fbcc359e8eb7647db5f5561247ac0eb4a5d7836
SHA3-384 hash:	414bf56e207c0875dbcd2d92a65aa16a9559cf5704e0144f271ec012b7f3e93f67636bf7df822912c6422f1e22e75fc5
SHA1 hash:	3a321815a69b5748db82e620dbbb4e826b665f34
MD5 hash:	00ba3961aaffa6ed4383eba067e05e56
humanhash:	carpet-yellow-mango-connecticut
File name:	xnxnxnxnxnxnxnxni386xnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	119'376 bytes
First seen:	2025-12-21 20:11:45 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:46tYsnDNjmN1VGQAjZMrRgSryQVroWgioF6:TnDNjmN1VGyVrUioU
TLSH	T146C35B82E6A2D0F1E28701B00557F3E68935EA305416CED6EFA93D71EC717829D9BB1C
telfhash	t1dd4107fa5ea60ce873d49c05d35e1730b909da3b687036aa40f31e7536fad9212b5c35
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 ae948107b21e72121fd4a53d79ba6097f68a0c78502ebd1b82db388dd09ffc98

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	60'772 bytes
File size (de-compressed) :	119'376 bytes
Format:	linux/i386
Packed file:	ae948107b21e72121fd4a53d79ba6097f68a0c78502ebd1b82db388dd09ffc98

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Mirai-10056451-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Kills processes

Locks files

Creating a file in the %temp% directory

Connection attempt

Substitutes an application name

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-12-21T18:23:00Z UTC

Last seen:

2025-12-21T18:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3bff12a909416b7ecdc2049f4fbcc359e8eb7647db5f5561247ac0eb4a5d7836/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/976c65c7-d43d-4d49-a470-5e4bc316431c

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d1fe1e7b-fa33-4619-9868-3afaf28391ce

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1837253

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/3bff12a909416b7ecdc2049f4fbcc359e8eb7647db5f5561247ac0eb4a5d7836

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/3bff12a909416b7ecdc2049f4fbcc359e8eb7647db5f5561247ac0eb4a5d7836/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2025-12-21 20:13:24 UTC

File Type:

ELF32 Little (Exe)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hp7rfkijifvx5tocaspu7pgdlhuow5sh3npvkyjeplaowss5pa3a._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/251221-yzne7szpfv/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Enumerates active TCP sockets

Enumerates running processes

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-10056451-0

YARA:

n/a

Link:

https://app.threat.zone/submission/7d8f3929-a28d-4c3e-ad1a-5f4aa1f1ecf2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.