🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570
SHA3-384 hash: 35a5fa27c161cd185a26aa114c4562c2b08e18e42b34a226006085be980c2a249bea33e32c13dbbeb96ba81447990876
SHA1 hash: f6c3eae854a53f4c101565e86784ce6a27089603
MD5 hash: e27dcb6c939d7aef554fdabba93dcfab
humanhash: red-sink-edward-uranus
File name:arm6
Download: download sample
Signature Mirai
Create hunting rule
File size:20'692 bytes
First seen:2026-09-13 16:24:11 UTC
Last seen:2026-09-14 12:02:23 UTC
File type: elf
MIME type:application/x-executable
ssdeep 384:Qs8o6sHxC/zzwp9cCMj6BRRInaKoSwfxNn7/zB8BHmdGU53DtB9ecF:jA8FC6BRRIavSiN7/KBH3UfF
TLSH T1BF92D16496C4C990C6701CBBD9AE87DAB33B02F8D49F701522718EC4FA8318A8379B47
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :20'692 bytes
File size (de-compressed) :38'088 bytes
Format:linux/arm
Unpacked file: 7eb5358f1c096d2a462b1749206e01960f57b3fda7ee866c9e35c81084f2f017

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ea065448-93e6-4048-8860-cfdf5db9e6d5/
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6aa6ce49275639cb9067664a/reports/b144fe76-928c-48c5-a48d-95939442251f/overview
Verdict:
Unknown
File Type:
elf.32.le
First seen:
2026-09-13T13:40:00Z UTC
Last seen:
2026-09-13T15:20:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c9966f7a-bd2d-4153-ad44-4741ded81af1
Behavior Graph:
Download SVG
%3 guuid=542bfc14-1c00-0000-8621-0d22e2090000 pid=2530 /usr/bin/sudo guuid=b8c04917-1c00-0000-8621-0d22e9090000 pid=2537 /tmp/sample.bin guuid=542bfc14-1c00-0000-8621-0d22e2090000 pid=2530->guuid=b8c04917-1c00-0000-8621-0d22e9090000 pid=2537 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/14c8a786-70fe-4ca3-8138-724e205f66fa
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1972357
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1972357 Sample: arm6.elf Startdate: 13/09/2026 Architecture: LINUX Score: 60 23 169.254.169.254, 80 USDOS-USDepartmentofStateUS ZZ 2->23 25 2.27.248.149, 11121, 37710, 37714 DEDIK-IODEDIKSERVICESLIMITEDDEDIKIOGB Germany 2->25 27 Antivirus / Scanner detection for submitted sample 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Sample is packed with UPX 2->31 9 arm6.elf 2->9         started        11 python3.8 dpkg 2->11         started        13 python3.8 dpkg 2->13         started        signatures3 process4 process5 15 arm6.elf 9->15         started        process6 17 arm6.elf 15->17         started        process7 19 arm6.elf 17->19         started        21 arm6.elf 17->21         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-09-13 16:25:59 UTC
File Type:
ELF32 Little (Exe)
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3nbzwsug2st3raos5hvif7yn2enue2aj7icpay752rwavkkwvya._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/260913-twragazcnh/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5eda1cda5436a53dc40e974f5417f86e88da13404fd027831feea360554ab570

(this sample)

Mirai

elf 7eb5358f1c096d2a462b1749206e01960f57b3fda7ee866c9e35c81084f2f017

  
URLhaus
https://urlhaus.abuse.ch/url/3916009/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 7eb5358f1c096d2a462b1749206e01960f57b3fda7ee866c9e35c81084f2f017
  
Dropping
MD5 47dc525ce2bf02a6ba4fe9d9d3587b31

Comments