MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f918f9409de0d5e84de2d0b47848113d6023e71e9ff2d03ac805db5f053f4fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments

SHA256 hash: 5f918f9409de0d5e84de2d0b47848113d6023e71e9ff2d03ac805db5f053f4fd
SHA3-384 hash: 3b51c12e1a5a020ca6592687b04abdd9bd109d3b73dad702469eb2bd8760a7d6913d1d1b72bb6582703bd70b2f919fe4
SHA1 hash: 05f4ca45573084b86805998ec0d3c3051c532224
MD5 hash: 990a1cf6e4952fe1383823a2984fe84e
humanhash: fruit-crazy-oklahoma-jupiter
File name:boatnet.m68k
Download: download sample
Signature Mirai
File size:53'024 bytes
First seen:2026-01-29 16:41:22 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:BoG7IMHSWSgciVCnXEgc8eh1gBUxCWQ1vtd:4DgcisnXxGu5W+7
TLSH T12E3319D6B5019DBCF95BEBBA8413460AF531B7561083063763BBFC53AC362A48E23D91
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
34
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2026-01-29T09:53:00Z UTC
Last seen:
2026-01-30T12:53:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.b
Status:
terminated
Behavior Graph:
%3 guuid=2e1c3a8d-1900-0000-2ce1-96d31c090000 pid=2332 /usr/bin/sudo guuid=9af1ca8f-1900-0000-2ce1-96d322090000 pid=2338 /tmp/sample.bin guuid=2e1c3a8d-1900-0000-2ce1-96d31c090000 pid=2332->guuid=9af1ca8f-1900-0000-2ce1-96d322090000 pid=2338 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre
Score:
60 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1859926 Sample: boatnet.m68k.elf Startdate: 29/01/2026 Architecture: LINUX Score: 60 24 169.254.169.254, 80 USDOSUS Reserved 2->24 26 31.56.120.29, 3778, 38158 RASANAIR Iran (ISLAMIC Republic Of) 2->26 28 daisy.ubuntu.com 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 Multi AV Scanner detection for submitted file 2->32 7 boatnet.m68k.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 7 other processes 2->13 signatures3 process4 process5 15 boatnet.m68k.elf 7->15         started        18 boatnet.m68k.elf 7->18         started        20 boatnet.m68k.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 34 Sample tries to kill multiple processes (SIGKILL) 15->34
Threat name:
Linux.Worm.Mirai
Status:
Malicious
First seen:
2026-01-29 12:41:26 UTC
File Type:
ELF32 Big (Exe)
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:mirai botnet:lzrd linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5f918f9409de0d5e84de2d0b47848113d6023e71e9ff2d03ac805db5f053f4fd

(this sample)

  
Delivery method
Distributed via web download

Comments