MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 413e82d69b73217b4ad4cbe1f8c6ce6f80f7e26da703acb280c6429747b274ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	413e82d69b73217b4ad4cbe1f8c6ce6f80f7e26da703acb280c6429747b274ce
SHA3-384 hash:	7da4525e47df49155efb2e352ea75c3826e93143909a7a451576bf956274ad759252cd1b9f9a7a0d068c5c6d42d0988d
SHA1 hash:	5d1314b95e4c55351440fa6dc150cd4ed902a36f
MD5 hash:	ddd4a96bf93c74eb0d6e7afab5d0c71c
humanhash:	network-comet-fanta-tennis
File name:	ppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	74'556 bytes
First seen:	2025-03-09 00:16:05 UTC
Last seen:	2025-03-09 00:54:24 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:FQJ3lF42Fb0XiKEK+QdG3gyVkkV4dMQfUbXNyc5ETHmrRfx:W15C080EqRfx
TLSH	T1E2736D41B7190987E1B35DB03B3F2BE1D3EA8E8221E46244785FFB859271E325446EDD
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67cce3771f777fe306083bd7linux22vpnfull_triage

Tags:

mirai

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Connection attempt

Receives data from a server

DNS request

Opens a port

Sends data to a server

Mounts file systems

Creating a file

Substitutes an application name

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin mirai remote

Link:

https://www.filescan.io/uploads/67ccddcfe95d0f9029e63d79/reports/5034f272-93cc-4c1e-856c-19cfb20bc659/overview

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0d134d3a-c026-4dd1-ad47-f45865bdfa91

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1632739

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/413e82d69b73217b4ad4cbe1f8c6ce6f80f7e26da703acb280c6429747b274ce

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/413e82d69b73217b4ad4cbe1f8c6ce6f80f7e26da703acb280c6429747b274ce/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2025-03-09 00:17:12 UTC

File Type:

ELF32 Big (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ie7ifvu3omqxwswuzpq7rrwon6appytnu4b2zmuayzbjor5sotha._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250309-akjlpsv1bx/

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f2269717-1843-4b37-a69b-969490179333

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/413e82d69b73217b4ad4cbe1f8c6ce6f80f7e26da703acb280c6429747b274ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.