MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229
SHA3-384 hash: 5f2acc4f966fb963ac0f5ea23726eeb653b78a38dbb0391db305f2d780b429e3b9de0900fc37904b651f26b186cc08a4
SHA1 hash: 9455aeab8309fc9c1cf0486ef31fc5bb9cb6056a
MD5 hash: 60d013d2d638f10062357fc9acea08dc
humanhash: mountain-xray-freddie-sierra
File name:x-3.2-.dick
Download: download sample
Signature Mirai
Create hunting rule
File size:174'977 bytes
First seen:2026-03-08 20:58:51 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:WV8Zmejb5Mbgkedez1W445HyvhyZBiLmJKNZY38IkhLRZa3itU:WVo659z1W55HyZyZ0LmJKNZY38IkhLR+
TLSH T158043AC1AA52FEB3D5C39FB502A7D71005B3E8255B5B8E01F3AEADF04A1A5C8B10975C
telfhash t132914328953d04d9af739d29a8696be34593e52622a4af29ff27ccc8040e46df215d0f
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Unix.Trojan.Gafgyt-6981156-0
Create hunting rule

Unix.Trojan.Mirai-9943729-0
Create hunting rule

Unix.Trojan.Mirai-10056463-0
Create hunting rule

Unix.Trojan.Mirai-10058414-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
gafgyt gcc masquerade mirai
Link:
https://www.filescan.io/uploads/69ade31997feb4afd6758e66/reports/0c6c7362-61d9-4eff-9d5f-55339b14a9d4/overview
Verdict:
Malicious
File Type:
elf.32.le
Link:
https://opentip.kaspersky.com/4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a46f07dc-74a2-4c75-b2cb-5c4f3674d32a
Behavior Graph:
Download SVG
%3 guuid=99276a87-1500-0000-c195-674ab50b0000 pid=2997 /usr/bin/sudo guuid=0cb8b089-1500-0000-c195-674abe0b0000 pid=3006 /tmp/sample.bin guuid=99276a87-1500-0000-c195-674ab50b0000 pid=2997->guuid=0cb8b089-1500-0000-c195-674abe0b0000 pid=3006 execve guuid=c467018a-1500-0000-c195-674ac00b0000 pid=3008 /tmp/sample.bin guuid=0cb8b089-1500-0000-c195-674abe0b0000 pid=3006->guuid=c467018a-1500-0000-c195-674ac00b0000 pid=3008 clone guuid=953a058a-1500-0000-c195-674ac10b0000 pid=3009 /tmp/sample.bin guuid=0cb8b089-1500-0000-c195-674abe0b0000 pid=3006->guuid=953a058a-1500-0000-c195-674ac10b0000 pid=3009 clone guuid=21d0098a-1500-0000-c195-674ac20b0000 pid=3010 /tmp/sample.bin guuid=0cb8b089-1500-0000-c195-674abe0b0000 pid=3006->guuid=21d0098a-1500-0000-c195-674ac20b0000 pid=3010 clone guuid=2d17148a-1500-0000-c195-674ac40b0000 pid=3012 /tmp/sample.bin zombie guuid=953a058a-1500-0000-c195-674ac10b0000 pid=3009->guuid=2d17148a-1500-0000-c195-674ac40b0000 pid=3012 clone guuid=fa8a238a-1500-0000-c195-674ac50b0000 pid=3013 /tmp/sample.bin guuid=21d0098a-1500-0000-c195-674ac20b0000 pid=3010->guuid=fa8a238a-1500-0000-c195-674ac50b0000 pid=3013 clone
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/56f08661-d6b0-4f35-8d33-b94d1fb20434
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-03-08 20:59:37 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ije3apyqadvouf35ohaegx7o2krpwtnmotii3xrbhoka4iyniiuq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery linux persistence
Link:
https://tria.ge/reports/260308-zsrdysbx9n/
Behaviour
Reads runtime system information
Changes its process name
Enumerates running processes
Modifies init.d
Modifies rc script
Write file to user bin folder
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 4249b03f1000eaea177d71c0435feed2a2fb4dac74d08dde213b940e230d4229

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3788908/
  
Delivery method
Distributed via web download

Comments