MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f
SHA3-384 hash: 385b1ddc645573277f51b401b2695acb3d3f65b9f2857fd76a622444d827b2fb8c8905847901cf6cb71d4bac08cc7ed7
SHA1 hash: 0bdb072d61d757db9c69bc50399773ce1e353518
MD5 hash: e728b03d67f62b16db92e21cf157c335
humanhash: equal-saturn-batman-blossom
File name:jew.mips
Download: download sample
Signature Mirai
Create hunting rule
File size:80'188 bytes
First seen:2025-12-02 03:30:56 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkRd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8L5
TLSH T17073A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA
telfhash t15c01e71c883413f0e7444dae67edff7ad18501ef49269f738e40fd9a9a11a46ad00c2d
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Detection(s):
Unix.Dropper.Mirai-7135870-0
Create hunting rule

Unix.Dropper.Mirai-7135939-0
Create hunting rule

Unix.Dropper.Mirai-7136025-0
Create hunting rule

Unix.Trojan.Mirai-9964459-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/692e5d9023d7ce46ce42d18b/reports/cfeef482-cbf9-4bbd-9a7e-5ab1c80ddafc/overview
Result
Gathering data
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dc690029-bc11-416f-b0d1-35dcd0a39d12
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1824090
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1824090 Sample: jew.mips.elf Startdate: 02/12/2025 Architecture: LINUX Score: 56 22 102.88.25.240 ZAINUGASUG Nigeria 2->22 24 128.105.191.179 WISC-MADISON-ASUS United States 2->24 26 98 other IPs or domains 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 8 jew.mips.elf 2->8         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 process5 14 jew.mips.elf 8->14         started        16 jew.mips.elf 8->16         started        process6 18 jew.mips.elf 14->18         started        20 jew.mips.elf 14->20         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-02 03:31:37 UTC
File Type:
ELF32 Big (Exe)
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jpwwjzpngby4x2rjci2v5o7aefwsd4xfouqcepwrxiyyzczci4xq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:kurc defense_evasion discovery
Link:
https://tria.ge/reports/251202-d3ay3azjdj/
Behaviour
System Network Configuration Discovery
Changes its process name
Writes file to system bin folder
Modifies Watchdog functionality
Contacts a large (116618) amount of remote hosts
Creates a large amount of network flows
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135870-0
YARA:
n/a
Link:
https://app.threat.zone/submission/0ea6bbf2-b1e0-496f-90f5-95e649442af2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3722684/
  
Delivery method
Distributed via web download

Comments