MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86
SHA3-384 hash: b6fe884e74f8d0876c9a84984eb0452ec60170e111b199da238408612694ba8e0a61dc12fd92dbf071bdea09a4e950f6
SHA1 hash: 81d0a4145d9683415f41b5d70f6c355456e87e9d
MD5 hash: e9ffd807cf8a6afbad50b7a84aa6269f
humanhash: wolfram-magazine-cat-beryllium
File name:plasma.sh4
Download: download sample
Signature Mirai
Create hunting rule
File size:660'128 bytes
First seen:2026-01-13 15:57:36 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 12288:t8nmyjsLB9hVjCcSq2KULZvZxuNY7Umf3qKyz8TQpEKraxv:QleBLVj8SU1H7QU
TLSH T113E4C093F2205EF6C41A0AB454BDE3304B45E69317877181F6BE82402C6F6A5FE6E7B4
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Unknown
File Type:
elf.32.le
First seen:
2026-01-13T14:27:00Z UTC
Last seen:
2026-01-13T14:32:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/57f70328-03ed-4c81-a204-1512b4bf350f
Behavior Graph:
Download SVG
%3 guuid=a9e58e58-1b00-0000-5be3-1067e50b0000 pid=3045 /usr/bin/sudo guuid=3ec6e25a-1b00-0000-5be3-1067ec0b0000 pid=3052 /tmp/sample.bin guuid=a9e58e58-1b00-0000-5be3-1067e50b0000 pid=3045->guuid=3ec6e25a-1b00-0000-5be3-1067ec0b0000 pid=3052 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4d4950d1-83ba-4778-8620-adaff34554dc
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1849954
Signature
Deletes all firewall rules
Executes the "iptables" command to insert, remove and/or manipulate rules
Sample tries to persist itself using cron
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1849954 Sample: plasma.sh4.elf Startdate: 13/01/2026 Architecture: LINUX Score: 52 66 169.254.169.254, 80 USDOSUS Reserved 2->66 68 15.204.230.147, 1337, 49220, 49222 HP-INTERNET-ASUS United States 2->68 70 2 other IPs or domains 2->70 9 plasma.sh4.elf 2->9         started        11 python3.8 dpkg 2->11         started        13 python3.8 dpkg 2->13         started        process3 process4 15 plasma.sh4.elf 9->15         started        process5 17 plasma.sh4.elf 15->17         started        20 plasma.sh4.elf 15->20         started        22 plasma.sh4.elf 15->22         started        24 140 other processes 15->24 file6 72 Sample tries to persist itself using cron 17->72 27 plasma.sh4.elf sh 17->27         started        29 plasma.sh4.elf sh 17->29         started        31 plasma.sh4.elf sh 20->31         started        33 plasma.sh4.elf sh 20->33         started        35 plasma.sh4.elf sh 22->35         started        37 plasma.sh4.elf sh 22->37         started        64 /etc/cron.d/sys_upd, ASCII 24->64 dropped 39 plasma.sh4.elf sh 24->39         started        41 plasma.sh4.elf sh 24->41         started        43 36 other processes 24->43 signatures7 process8 process9 51 2 other processes 27->51 45 sh chmod 29->45         started        54 2 other processes 31->54 47 sh chmod 33->47         started        56 2 other processes 35->56 49 sh chmod 37->49         started        58 2 other processes 39->58 60 2 other processes 41->60 62 51 other processes 43->62 signatures10 74 Deletes all firewall rules 62->74 76 Executes the "iptables" command to insert, remove and/or manipulate rules 62->76
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-01-13 15:45:33 UTC
File Type:
ELF32 Little (Exe)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kr6v5e54vpu6g2tpljptosgx26ijwn5vkvse5vkqnqdgttrvhoda._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260113-tepqbabz4c/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/eadc4e8c-cf5c-44ac-beed-419da5081357
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202503_elf_Mirai
Create hunting rule
Author:abuse.ch
Description:Detects Mirai 'TSource' ELF files
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:malwareelf55503
Create hunting rule
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3757312/
  
Delivery method
Distributed via web download

Comments