MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67
SHA3-384 hash:	58f46ddbeb70bf4f9c853bd9452a9d6649e7d51dfbe69986fe7be220c21d4c9256201e89d8adcffcfd5ba30cd696327c
SHA1 hash:	c76188661f94ca1462ddaead58b8005a8ba5dabe
MD5 hash:	fa314893a26b9175112f9a99fca188b8
humanhash:	carbon-summer-carbon-princess
File name:	jklx86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	87'444 bytes
First seen:	2026-01-24 12:17:45 UTC
Last seen:	2026-01-24 19:36:01 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:MB05O/EmwjFuMf8l6+iUyOwhJq2naFu/TUL3E6V4rHR3IK96+avYqfJ8uD:MBSgzmYMf4OTJVaFu/TeV2rHJIQ6tQ3u
TLSH	T197835AC2A283E4F5E9180175207AF33BB632DDB90064FDF7F76456379826650B18A78E
telfhash	t19c31e5bd26321dd4dbd08d22f20c9760dd1eeb7b501077b315b65828322658253bbd3a
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

47

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-7755770-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885259-0

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6974b89255805a763ff41e3e/reports/519b9eb4-2f42-4fcd-be6e-c202d6233ea1/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

37

Number of processes launched:

4

Processes remaning?

false

Remote TCP ports scanned:

23

Full report:

https://elfdigest.com/brief/516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest

Result

Gathering data

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/29b628da-bf0d-483a-9754-48f58bbce07e

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e49df824-e496-4a37-9365-b7e05b72ba86

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1856754

Signature

Drops invisible ELF files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-24 12:18:27 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 23 (65.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kfxcs65epofco3dysrcack35iuqlkbwa7vd3utgs4xgusbnizjtq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260124-pxqywacv7a/

Behaviour

Reads runtime system information

Writes file to shm directory

Enumerates running processes

Deletes itself

Executes dropped EXE

Contacts a large (48157) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/516e297ba47b8a276c789444012b7d4520b506c0fd47ba4cd2e5cd4905a8ca67