MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7
SHA3-384 hash:	ad672d66c00426cb691f8ea0cf2a864efbce513e972bcc0c1cb1fb03be121623a2241b6cd61d85208477c927c7bfb7d2
SHA1 hash:	7e85fd21a1138cd6496c0ec6abbead85f227b98e
MD5 hash:	4e7f54cbe49734c94f117b3d28ba26f6
humanhash:	moon-arizona-rugby-august
File name:	arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	38'000 bytes
First seen:	2025-08-18 04:00:58 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:itnT+P59wrHHsT744U/fWm+7elMx14zixPe45WrkwgVv:itnaP5SHsm3jMxmixPX5Wr8
TLSH	T1AA03E69AF9919B12C5D15279FF0E118D33270B6CE3EEB3125E247B34678B56B0B3A805
telfhash	t19911ab214a98ae0ef6d48057f2fd4616d61ae6a53b7e1c0736f7e86e1507cf01224a88
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

rust

Link:

https://www.filescan.io/uploads/68a2a59f419c816a6e89e132/reports/0ef00f3e-a7c1-41af-9dfa-d1ba1687e0b9/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/56332ce3-7f49-4756-8942-4df9a0b04a61

Behavior Graph:

Download SVG

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b93c20e6-69c6-44a3-87dd-c74761e96d8e

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1759026

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-08-18 04:01:35 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i5e4fmdghsvb6oflkpsf2giyochmy6gk3ls5rkxrrszenry65k3q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250818-elh4sazmt5/

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9b4136ef-cba4-4690-bbec-5e4bab8b6cf9

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4749c2b0663caa1f38ab53e45d1918708ecc78cadae5d8aaf18cb246c71eeab7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.