MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3
SHA3-384 hash:	22e823953578634201cb8ae0daee9ec5258925d98bc1db0c0123ee7dea2bb3a25db13c19950cbcd46686dc76b062efa1
SHA1 hash:	047bfab761e1a2d47818f94408a80d118e67c192
MD5 hash:	b53626b25238a22e73e57eb5956bd2d6
humanhash:	fourteen-pip-minnesota-lemon
File name:	5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3.elf
Download:	download sample
Signature	Mirai Create hunting rule
File size:	84'496 bytes
First seen:	2026-08-06 23:34:10 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	1536:p2r7eCANVC3phe+ThBwhPhomPMjoQD0QrxUI2dJvmQNvYiZDt9L8uojWxUXGuIjN:p2HeCEC5nLW50MQFrx4JvmmYiB9oYOGL
TLSH	T1C78312D9DC6756B1F657BAD3082C6FE12A42C0AE5E0C51831F4873A14E86DDC9D36D23
Magika	flv
Reporter	whack_sh
Tags:	elf exe UPX whack.sh

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	84'496 bytes
File size (de-compressed) :	185'240 bytes
Format:	linux/mips
Unpacked file:	611c02afa2bc725622b7c5154f69b4d5b4f409a46f93ba67dbddcb224d90efc6

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0274302f-e9cc-42f8-99a5-9ae219ea70fb/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creates or modifies symbolic links

Creating a file

Connection attempt

Sets a written file as executable

Changes access rights for a written file

Changes the time when the file was created, accessed, or modified

Runs as daemon

Opens a port

Writes files to system directory

Creates or modifies files in /cron to set up autorun

Substitutes an application name

Deleting of the original file

Creates or modifies files in /init.d to set up autorun

Creates or modifies symbolic links in /init.d to set up autorun

Creates or modifies files to set up autorun

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai packed upx

Link:

https://www.filescan.io/uploads/6a7519ffd04d8b85fd7e9e24/reports/df28f5b7-bf0a-45fc-915c-896d4a82f122/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2026-08-06T20:31:00Z UTC

Last seen:

2026-08-06T20:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c0605d17-cf8d-48f5-8dba-1117e46f9452

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/66c4032e-9b04-4bc7-8251-5f35a679481d

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ln6opxknvzcpocwzjjewluat3e2uwbrpr3f2smaf3vtrpndc5lrq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

upx

Link:

https://tria.ge/reports/260806-3klqaach42/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5b7ce7dd4dae44f70ad94a4965d013d9354b062f8ecba93005dd6717b462eae3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	elf_arm_mips_ko_so Create hunting rule

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research