MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e
SHA3-384 hash:	523c633ac91e94a63ec358536833fa5ebdec690f02b60c9f151d36e9198a966af1d2cb98087b494c481078ed9645c35b
SHA1 hash:	34b6c0cbb22b2fc9b4284c867744811f0eb1d333
MD5 hash:	9b78d2f108cc54f8132529aaf5f6ee82
humanhash:	mississippi-papa-yellow-eighteen
File name:	persist.arm7
Download:	download sample
Signature	Mirai Create hunting rule
File size:	61'356 bytes
First seen:	2026-08-22 14:10:36 UTC
Last seen:	2026-08-23 12:54:07 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:+NOlFxeA3wSfRvAUH8WKc8W96YtrOiLXzkISgLe/NLv6TB:+UlF5AkRvA68DcH6YtrOiLXzk7HNLv69
TLSH	T13C5301887EE3EE6191308773CC2957E9F10E057CC2F3B06252D1AB641777A142BDA69D
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	BlinkzSec
Tags:	mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	61'356 bytes
File size (de-compressed) :	157'681 bytes
Format:	linux/arm
Unpacked file:	8b0fbe0d0f71f5bec7da3cefe071135665a760645f8e46faa2f93abef24f5980

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2a932da1-d9f0-49a7-8a34-d8eb28350afb/

Detection(s):

SecuriteInfo.com.Linux.Mirai.9816.28164.29793.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Connection attempt

Sends data to a server

Receives data from a server

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade mirai packed upx

Link:

https://www.filescan.io/uploads/6a89ae4256fb9e3a839c4198/reports/b87330a2-6d86-4e80-afd0-459f21a0773a/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e

Behaviour

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/afb0281d-6328-466f-9b42-b58c433775a7

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1e30bee5-a614-49f2-be3f-a75a713aa2a7

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2026-08-20 03:25:00 UTC

File Type:

ELF32 Little (Exe)

AV detection:

20 of 36 (55.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iigrpqyuj5nbo7k5bytahre47btydbpdlujo5xfxdmod2tuc6oha._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd botnet defense_evasion discovery upx

Link:

https://tria.ge/reports/260822-rhfwgavfph/

Behaviour

Reads runtime system information

Enumerates running processes

Writes file to system bin folder

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

77.239.124.123

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/420d17c3144f5a177d5d0e2603c49cf8678185e35d12eedcb71b1c3d4e82f38e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_DVR_Botnet_Hama_UPX Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects packed and unpacked ELF IoT/DVR botnet variants targeting UPX compression structures and uncompressed code

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/