MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418
SHA3-384 hash:	4581edd3096cdba4e57c91aea5ed86a557daeb31d28587912a4befcf45123858855b3aa069e8411441de3a1734aa4e5a
SHA1 hash:	115d5ef64d71ea5e75054827df5a3e78e0c1dcbe
MD5 hash:	ae8bb43e19fc707ae606cd434150b776
humanhash:	carpet-finch-lactose-foxtrot
File name:	skid.armv5l
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	115'464 bytes
First seen:	2025-04-18 02:05:04 UTC
Last seen:	2025-04-18 17:26:35 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:f/n9XhMzD/MuFXC5sxK6/1jgnmx6uMSOiouOOssr4t9U3wR5S2rhgroZ/8vcQ+Jt:Zh+MA3xK6/1kmx6ZSEGssLZ2rhRNLQi
TLSH	T1A9B30B8DA8616B25C1E969BAFE5D44CD330217FCD2EA71158D065F20A78F88D0E3EBC5
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

93

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.ELF.Mirai-CQU.28548.5888.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6801b707280f5f89a0d0e597linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Receives data from a server

DNS request

Opens a port

Sends data to a server

Creating a file

Substitutes an application name

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6801b36c89fec6b88b9edb3f/reports/0433ab67-a0f4-403b-843f-4ea4f7f6e79e/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

151

Number of processes launched:

2

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 74.125.250.129:19302

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bcbadd4f-1ce9-4fe1-a735-4907de97905e

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1668092

Signature

Connects to many ports of the same IP (likely port scanning)

Performs DNS TXT record lookups

Suricata IDS alerts for network traffic

Uses STUN server to do NAT traversial

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-18 05:16:18 UTC

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kgmusmlrunvcug5h3xw3qfgkv62xzun4wbd3vhoieuzxlyniwqma._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access discovery

Link:

https://tria.ge/reports/250418-ch46qsyyc1/

Behaviour

Reads runtime system information

Changes its process name

Reads process memory

Enumerates running processes

Renames itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5199493171a36a2a1ba7ddedb814caafb57cd1bcb047ba9dc8253375e1a8b418