🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18
SHA3-384 hash: 210ce806ca5fe35232c3262e8aa7ca1bd4ce9fada128ee1d147efd95ee452f2032270e88d260d3321d7c1bc01b0df309
SHA1 hash: 818a8e6a4553a525d9b310370786a5b4b35669db
MD5 hash: e387fbdca9b23aa86b2582502840cd32
humanhash: charlie-coffee-oranges-rugby
File name:system_x86_64
Download: download sample
Signature Mirai
Create hunting rule
File size:184'296 bytes
First seen:2026-08-26 15:46:52 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:SN1/K3h1tJOROC7PXvlHA2UcJC4YbbqjBq4SCAsRdvLu9h8sAFDEquG1gyXa:SN1/K3h1tJOROCbf+2Ucg4YV43j3VFM
TLSH T1A8044A06B5C180FDC4C9C1744BABB63ADE35B45D513CB2BB27C4AF162E8DE305A2EA54
telfhash t11451ab642da2395c20ebc70b734eda1afcb200015e9279e5ae1b3d95dd43b8c5d66453
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 a1200fa2f0d2b3f4fa3fd9625a31b5c8c8613a0d8b9ddb94f0d574a4bef9c0db
File size (compressed) :68'228 bytes
File size (de-compressed) :184'296 bytes
Format:linux/amd64
Packed file: a1200fa2f0d2b3f4fa3fd9625a31b5c8c8613a0d8b9ddb94f0d574a4bef9c0db

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Dropper.Mirai-7135965-0
Create hunting rule

Unix.Dropper.Mirai-7540662-0
Create hunting rule

Unix.Trojan.Mirai-10027280-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Opens a port
Connection attempt
Substitutes an application name
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
botnet mirai
Link:
https://www.filescan.io/uploads/6a8f0a860feffa38c0c13ae2/reports/b16bcdc9-ed37-42ea-806e-9632d89f4cef/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2026-08-26T13:53:00Z UTC
Last seen:
2026-08-27T18:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ebc99caf-8764-4b7b-83aa-d21787b689d7
Behavior Graph:
Download SVG
%3 guuid=a081a060-1b00-0000-dd76-67d7530b0000 pid=2899 /usr/bin/sudo guuid=fd0a0263-1b00-0000-dd76-67d7590b0000 pid=2905 /tmp/sample.bin net guuid=a081a060-1b00-0000-dd76-67d7530b0000 pid=2899->guuid=fd0a0263-1b00-0000-dd76-67d7590b0000 pid=2905 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=fd0a0263-1b00-0000-dd76-67d7590b0000 pid=2905->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907 /tmp/sample.bin dns net send-data zombie guuid=fd0a0263-1b00-0000-dd76-67d7590b0000 pid=2905->guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907 clone guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 35B bc8d6c88-0f43-5d54-9832-eb541ec09e4c vivi.diconest.com:108 guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->bc8d6c88-0f43-5d54-9832-eb541ec09e4c send: 227B guuid=89328b63-1b00-0000-dd76-67d75d0b0000 pid=2909 /tmp/sample.bin guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->guuid=89328b63-1b00-0000-dd76-67d75d0b0000 pid=2909 clone guuid=4bd6df63-1b00-0000-dd76-67d7600b0000 pid=2912 /tmp/sample.bin net net-scan send-data guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->guuid=4bd6df63-1b00-0000-dd76-67d7600b0000 pid=2912 clone guuid=cd63d86d-1b00-0000-dd76-67d7810b0000 pid=2945 /tmp/sample.bin send-data guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->guuid=cd63d86d-1b00-0000-dd76-67d7810b0000 pid=2945 clone guuid=4517886e-1b00-0000-dd76-67d7850b0000 pid=2949 /tmp/sample.bin send-data guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->guuid=4517886e-1b00-0000-dd76-67d7850b0000 pid=2949 clone guuid=d791cb6f-1b00-0000-dd76-67d7890b0000 pid=2953 /tmp/sample.bin send-data guuid=cc2b4963-1b00-0000-dd76-67d75b0b0000 pid=2907->guuid=d791cb6f-1b00-0000-dd76-67d7890b0000 pid=2953 clone guuid=b6a34e64-1b00-0000-dd76-67d7620b0000 pid=2914 /tmp/sample.bin zombie guuid=89328b63-1b00-0000-dd76-67d75d0b0000 pid=2909->guuid=b6a34e64-1b00-0000-dd76-67d7620b0000 pid=2914 clone guuid=4bd6df63-1b00-0000-dd76-67d7600b0000 pid=2912|network network activity to 1025 IP addresses review logs to see them all guuid=4bd6df63-1b00-0000-dd76-67d7600b0000 pid=2912->guuid=4bd6df63-1b00-0000-dd76-67d7600b0000 pid=2912|network network guuid=cd63d86d-1b00-0000-dd76-67d7810b0000 pid=2945->bc8d6c88-0f43-5d54-9832-eb541ec09e4c send: 67B guuid=2dbdc66e-1b00-0000-dd76-67d7870b0000 pid=2951 /tmp/sample.bin guuid=cd63d86d-1b00-0000-dd76-67d7810b0000 pid=2945->guuid=2dbdc66e-1b00-0000-dd76-67d7870b0000 pid=2951 clone guuid=4517886e-1b00-0000-dd76-67d7850b0000 pid=2949->bc8d6c88-0f43-5d54-9832-eb541ec09e4c send: 163B guuid=4683da6e-1b00-0000-dd76-67d7880b0000 pid=2952 /tmp/sample.bin guuid=4517886e-1b00-0000-dd76-67d7850b0000 pid=2949->guuid=4683da6e-1b00-0000-dd76-67d7880b0000 pid=2952 clone guuid=d791cb6f-1b00-0000-dd76-67d7890b0000 pid=2953->bc8d6c88-0f43-5d54-9832-eb541ec09e4c send: 260B guuid=9769f770-1b00-0000-dd76-67d78a0b0000 pid=2954 /tmp/sample.bin guuid=d791cb6f-1b00-0000-dd76-67d7890b0000 pid=2953->guuid=9769f770-1b00-0000-dd76-67d78a0b0000 pid=2954 clone
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db8367f5-32f1-4c5b-9055-cb1b43f3849a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-08-26 15:47:30 UTC
File Type:
ELF64 Little (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jm5lfjcpwsubd4p32jsih6qj5p5ugveynnjr75p6ealeknmrrqma._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-s8dpgafp4y/
Behaviour
Reads runtime system information
Changes its process name
Enumerates running processes
Modifies Watchdog functionality
Contacts a large (1035) amount of remote hosts
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Gafgyt_0cd591cd
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_33b4111a
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_620087b9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_807911a2
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_9e9530a7
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_a33a8363
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d0c57a2e
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d4227dbf
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d996d335
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_01e4a728
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_0bce98a2
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_520deeb8
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_95e0056c
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_e0cf29e2
Create hunting rule
Author:Elastic Security
Rule name:MatchByteSequence
Create hunting rule
Author:Generated by ChatGPT
Description:Rule to match specific byte sequence: 89 C8 C1 E8 08 31 D1 31 C8
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Mirai_Botnet_Malware
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Mirai Botnet Malware
Reference:Internal Research
Rule name:Mirai_Botnet_Malware_RID2EF6
Create hunting rule
Author:Florian Roth
Description:Detects Mirai Botnet Malware
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf a1200fa2f0d2b3f4fa3fd9625a31b5c8c8613a0d8b9ddb94f0d574a4bef9c0db

Mirai

elf 4b3ab2a44fb4a811f1fbd26483fa09ebfb4354986b531ff5fe20164535918c18

(this sample)

  
Dropped by
SHA256 a1200fa2f0d2b3f4fa3fd9625a31b5c8c8613a0d8b9ddb94f0d574a4bef9c0db
  
URLhaus
https://urlhaus.abuse.ch/url/3908533/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 f414ee8a79ddd07e3b6c233c3642466c

Comments