MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6
SHA3-384 hash: d3491312e73c2cc0fce863ab7ee9fdd2f364cf6af02ace3b277075b694f3f9e867b896232c3d3c772de541367610ed78
SHA1 hash: 304c1799c370f334dc0c075a8688b7cbb799b4fb
MD5 hash: 6f1ab134f2739e71ee8890d740296028
humanhash: pennsylvania-island-black-speaker
File name:hoho.spc
Download: download sample
Signature Mirai
Create hunting rule
File size:49'996 bytes
First seen:2026-02-28 14:58:49 UTC
Last seen:2026-02-28 18:24:31 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:6nJJnLVSRf53SjfTvxCrDwjaGPBH0oKai:QEB5CjLwrLalKai
TLSH T1F5233936B97A2E17C8C4A47E22F74734B2F5524E25B8CA2E3D720E4EFF10944A5136B5
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Dropper.Mirai-7135890-0
Create hunting rule

Unix.Dropper.Mirai-7135939-0
Create hunting rule

Unix.Dropper.Mirai-7136025-0
Create hunting rule

Result
Gathering data
Verdict:
Malicious
File Type:
elf.32.be
Link:
https://opentip.kaspersky.com/47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1e27c0d6-6083-42f4-8404-1eeab9d72944
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1876382
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1876382 Sample: hoho.spc.elf Startdate: 28/02/2026 Architecture: LINUX Score: 60 56 202.137.33.173 ZLANZTVCOLTDJP Japan 2->56 58 43.241.39.130 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->58 60 98 other IPs or domains 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 Multi AV Scanner detection for submitted file 2->64 10 hoho.spc.elf 2->10         started        signatures3 process4 process5 12 hoho.spc.elf 10->12         started        15 hoho.spc.elf 10->15         started        17 hoho.spc.elf 10->17         started        signatures6 68 Sample tries to kill multiple processes (SIGKILL) 12->68 19 hoho.spc.elf 12->19         started        21 hoho.spc.elf 12->21         started        23 hoho.spc.elf 15->23         started        26 hoho.spc.elf 15->26         started        28 hoho.spc.elf 15->28         started        30 2 other processes 15->30 process7 signatures8 32 hoho.spc.elf 19->32         started        34 hoho.spc.elf 19->34         started        36 hoho.spc.elf 19->36         started        46 2 other processes 19->46 66 Sample tries to kill multiple processes (SIGKILL) 23->66 38 hoho.spc.elf 23->38         started        40 hoho.spc.elf 23->40         started        42 hoho.spc.elf 23->42         started        44 hoho.spc.elf 23->44         started        process9 process10 48 hoho.spc.elf 32->48         started        50 hoho.spc.elf 32->50         started        52 hoho.spc.elf 32->52         started        54 hoho.spc.elf 32->54         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-02-28 14:54:52 UTC
File Type:
ELF32 Big (Exe)
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7o6vmtplcx7izju3wwegfx4527tbppyv5lu42tv3lkahv6bnhla._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260228-scwkeabw5b/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3787555/
  
Delivery method
Distributed via web download

Comments