MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c
SHA3-384 hash:	557e6a184fc316d08fcf8e69585b58acd31877509aadc5283e728f8a5b1d79c886ec871e09ad56aa02c4d3d74e103c1b
SHA1 hash:	9f7b5e530eb59552dfd85bad13dbdb032fe802fd
MD5 hash:	9d2fa56758f2f124c7d961a1f2017f52
humanhash:	six-london-winner-glucose
File name:	TRC.sh4
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	42'676 bytes
First seen:	2025-11-10 16:21:21 UTC
Last seen:	2025-11-11 02:20:56 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:Xad0wtw3XyPp+leFMeyiKrKUnUAwkwNoZMCroZFkC7:XaewtwndMMFBUcMaMT3kC7
TLSH	T104138E76C86D9DD4C2448A78A935CE781F63F104C2671EFA1E9A85A68043DFCFA093F5
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

147

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Dropper.Mirai-7135890-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135939-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7136025-0

Alert

Create hunting rule

Unix.Trojan.Mirai-7138377-0

Alert

Create hunting rule

Unix.Trojan.Mirai-7674518-0

Alert

Create hunting rule

Unix.Trojan.Generic-9910199-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10057021-0

Alert

Create hunting rule

FileScan.io

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-10T13:41:00Z UTC

Last seen:

2025-11-12T07:11:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b

Link:

https://opentip.kaspersky.com/3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/03572395-d98d-44f6-a89b-1e4d5f54cf2f

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2b1bfa6d-883e-4f21-9fbe-0eae7cc8c197

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1811514

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-10 16:18:15 UTC

File Type:

ELF32 Little (Exe)

AV detection:

22 of 36 (61.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h4ozvhe5w2mf62h5c4vdugxodlqv3ld5rvsm5pbccodhosy3vbwa._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai linux

Link:

https://tria.ge/reports/251110-tvbhma1kcn/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135890-0

YARA:

n/a

Link:

https://app.threat.zone/submission/7d6c1161-74cb-40fe-8faa-48be31df5b31

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3f1d9a9c9db6985f68fd172a3a1aee1ae15dac7d8d64cebc221386774b1ba86c