🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321
SHA3-384 hash: 0268a4554d9a1a36d10d69bbe795d533ed8bdbe3c95230a318d448710d60536a51fd94b142e60a4e2c6d073a706bac35
SHA1 hash: 77d61004de10d986e70c84766b8450d884040fad
MD5 hash: f1874790bc9d09f33514182815e98045
humanhash: papa-bluebird-uniform-jersey
File name:dissarm7
Download: download sample
Signature Mirai
Create hunting rule
File size:198'424 bytes
First seen:2026-10-11 04:21:51 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:RLzAbIT5uTRFFyaUcyqGFTdd5mfmB/Qdp8IVN:RLzAsTwvFyaUcIFTddk+Bc8IVN
TLSH T120141859FC81AF10D5D536BAFA5E428933671778E3FA7102AE205F2023CA91F0F7A516
telfhash t10eb012c408032dc8772156c5c7fdd3063907e0270ed8002610c87ea6dd733b1c47209a
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Mirai.9829.30945.18257.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Manages services
Runs as daemon
Creating a process from a recently created file
Creating a file
Creating a file in the %temp% directory
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bashlite expand lolbin mirai rust
Link:
https://www.filescan.io/uploads/6acb0efb2d6e22e93281e8ca/reports/5e98cbfa-c6dc-44cd-a9e6-c6d2047b7651/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
32
Number of processes launched:
1051
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321
Behaviour
Persistence
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Unknown
File Type:
elf.32.le
First seen:
2026-10-11T04:49:00Z UTC
Last seen:
2026-10-12T05:04:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/177799c3-2190-410e-86c3-9e306295dafa
Behavior Graph:
Download SVG
%3 guuid=58c0f6f2-1600-0000-bccd-925fc30d0000 pid=3523 /usr/bin/sudo guuid=b1f8def4-1600-0000-bccd-925fc90d0000 pid=3529 /tmp/sample.bin guuid=58c0f6f2-1600-0000-bccd-925fc30d0000 pid=3523->guuid=b1f8def4-1600-0000-bccd-925fc90d0000 pid=3529 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7ca837d-3acd-47ef-959a-7f93c0e3c675
Result
Threat name:
Mirai, Gafgyt
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1985386
Signature
Antivirus detection for dropped file
Detected Mirai
Drops files in suspicious directories
Found malware configuration
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Multi AV Scanner detection for submitted file
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Suricata IDS alerts for network traffic
Terminates several processes with shell command 'killall'
Yara detected Gafgyt
Yara detected ShellDownloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1985386 Sample: dissarm7.elf Startdate: 11/10/2026 Architecture: LINUX Score: 100 189 104.168.4.206, 40094, 40096, 40098 AS-COLOCROSSING-HostPapaUS United States 2->189 199 Suricata IDS alerts for network traffic 2->199 201 Found malware configuration 2->201 203 Antivirus detection for dropped file 2->203 205 4 other signatures 2->205 15 dissarm7.elf 2->15         started        19 systemd dissarm7.elf 2->19         started        21 systemd snapd-env-generator 2->21         started        23 39 other processes 2->23 signatures3 process4 file5 183 /var/spool/cron/crontabs/root, ASCII 15->183 dropped 185 /etc/rc.local, POSIX 15->185 dropped 191 Sample tries to set files in /etc globally writable 15->191 193 Drops files in suspicious directories 15->193 195 Sample tries to persist itself using cron 15->195 197 Sample tries to persist itself using System V runlevels 15->197 25 dissarm7.elf sh 15->25         started        27 dissarm7.elf sh 15->27         started        29 dissarm7.elf sh 15->29         started        37 4 other processes 15->37 187 /etc/init.d/systemd-resolved-helper, POSIX 19->187 dropped 31 dissarm7.elf sh 19->31         started        33 dissarm7.elf sh 19->33         started        35 dissarm7.elf sh 19->35         started        39 4 other processes 19->39 signatures6 process7 process8 41 sh dissarm7.elf 25->41         started        57 2 other processes 25->57 45 sh ln 27->45         started        47 sh ln 29->47         started        49 sh dissarm7.elf 31->49         started        51 sh systemctl 33->51         started        53 sh systemctl 35->53         started        59 4 other processes 37->59 55 sh systemctl 39->55         started        file9 177 /root/.bashrc, ASCII 41->177 dropped 179 /etc/profile.d/kworker.sh, ASCII 41->179 dropped 181 /etc/profile, ASCII 41->181 dropped 211 Sample tries to persist itself using /etc/profile 41->211 213 Drops files in suspicious directories 41->213 215 Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions 41->215 61 dissarm7.elf sh 41->61         started        63 dissarm7.elf 41->63         started        65 dissarm7.elf sh 41->65         started        73 4 other processes 41->73 217 Sample tries to persist itself using System V runlevels 45->217 67 dissarm7.elf sh 49->67         started        75 3 other processes 49->75 69 systemctl systemd-sysv-install 51->69         started        71 dissarm7.elf sh 57->71         started        77 3 other processes 57->77 219 Terminates several processes with shell command 'killall' 59->219 signatures10 process11 process12 86 4 other processes 61->86 88 33 other processes 63->88 79 sh ln 65->79         started        82 sh dissarm7.elf 67->82         started        90 3 other processes 69->90 84 sh dissarm7.elf 71->84         started        92 4 other processes 73->92 94 3 other processes 75->94 96 2 other processes 77->96 signatures13 225 Sample tries to persist itself using System V runlevels 79->225 98 dissarm7.elf sh 82->98         started        108 3 other processes 82->108 110 4 other processes 84->110 227 Drops files in suspicious directories 86->227 100 dissarm7.elf sh 86->100         started        112 13 other processes 86->112 114 5 other processes 88->114 102 update-rc.d systemctl 90->102         started        104 systemctl systemd-sysv-install 94->104         started        106 systemctl systemd-sysv-install 96->106         started        process14 file15 117 sh dissarm7.elf 98->117         started        119 sh dissarm7.elf 100->119         started        124 2 other processes 100->124 126 3 other processes 104->126 128 3 other processes 106->128 130 3 other processes 108->130 132 3 other processes 110->132 122 sh dissarm7.elf 112->122         started        134 7 other processes 112->134 175 /var/tmp/.kworker, Bourne-Again 114->175 dropped process16 signatures17 144 3 other processes 117->144 207 Drops files in suspicious directories 119->207 146 7 other processes 119->146 148 4 other processes 122->148 150 4 other processes 124->150 136 update-rc.d systemctl 126->136         started        138 update-rc.d systemctl 128->138         started        140 systemctl systemd-sysv-install 130->140         started        152 5 other processes 132->152 209 Sample tries to persist itself using System V runlevels 134->209 142 systemctl systemd-sysv-install 134->142         started        process18 process19 161 3 other processes 140->161 163 3 other processes 142->163 154 sh dissarm7.elf 144->154         started        165 2 other processes 144->165 156 sh dissarm7.elf 146->156         started        167 7 other processes 146->167 159 sh dissarm7.elf 148->159         started        169 2 other processes 148->169 171 8 other processes 152->171 signatures20 221 Drops files in suspicious directories 156->221 173 dissarm7.elf sh 156->173         started        223 Sample tries to persist itself using System V runlevels 167->223 process21
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-10-11 04:22:39 UTC
File Type:
ELF32 Little (Exe)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6je2w4odehosarpzaq64mf7xqgzdr6ivfv2ygunftx4dq4hqmqq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/261011-ezbxmaxz2j/
Behaviour
Command and Scripting Interpreter: Unix Shell
Reads runtime system information
Writes file to tmp directory
Modifies systemd
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202503_elf_Mirai
Create hunting rule
Author:abuse.ch
Description:Detects Mirai 'TSource' ELF files
Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:ELF_Packer_Dropper_Fileless_Armhf
Create hunting rule
Author:Serhii Kocherhan
Description:Detects obfuscated Linux ELF packers/droppers featuring ChaCha20/RC4 decryption, memfd_create/execveat fileless execution capabilities, and unique binary artifacts.
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:linux_generic_irc_catcher
Create hunting rule
Author:@_lubiedo
Description:Find new ELF IRC samples
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5f924d5b8e190ee9022fc821ee30bfbc0d91c7c8a96bac1a8d2cefc1c3878321

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3927811/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3929220/

Comments