MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0
SHA3-384 hash: 5ee9a0e9c5ec2d737702d349e773af231fbcd946c00e1118ac425063dbf5d19a352fc23f36e00ccbbc924768a83d3e51
SHA1 hash: bd9f1a8821f349dd9ea6a90d104dfda3f338db22
MD5 hash: ae2a7ee89da71452ca2fbaf3f8abae87
humanhash: failed-blue-alanine-pasta
File name:ntb.mips
Download: download sample
Signature Mirai
Create hunting rule
File size:305'980 bytes
First seen:2026-08-08 18:01:50 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:jsYFmzasnrVlwxKyuBSP/yRnSikp7Q/4haCdfV1:AYKznjwEbUvbhTz1
TLSH T166548E0377614F89F325D17105F38563AAE926D71BE2C496D33DEA113A20E89383BF69
telfhash t18ee0ec28983c63f0c089cd1e52ddef3599e194eb957a0d0bc504d8796771c839d00c34
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 01d31eb4fec94f20d367b61ea0a304023b68fefb2606452a684c2a8cf64ebb06
File size (compressed) :128'608 bytes
File size (de-compressed) :305'980 bytes
Format:linux/mips
Packed file: 01d31eb4fec94f20d367b61ea0a304023b68fefb2606452a684c2a8cf64ebb06

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Mirai-31.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29052.TSource.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-9441505-0
Create hunting rule

Unix.Trojan.Mirai-10011027-0
Create hunting rule

Unix.Trojan.Mirai-10011918-0
Create hunting rule

Unix.Trojan.Mirai-10058997-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Manages services
Creating a process from a recently created file
Creating a file
Collects information on the RAM
Sends data to a server
Sets a written file as executable
Creating a file in the %temp% directory
Kills processes
Runs as daemon
Collects information on the CPU
Creates or modifies files in /cron to set up autorun
Substitutes an application name
Creates or modifies files in /init.d to set up autorun
Creates or modifies symbolic links in /init.d to set up autorun
Creates or modifies files to set up autorun
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
gcc masquerade
Link:
https://www.filescan.io/uploads/6a776f377fce16fded1964c3/reports/eb1fe84b-c222-4880-af39-d2f97a01ca3f/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/88d0f5e5-dc4b-4482-ada4-335188d42da6
Behavior Graph:
Download SVG
%3 guuid=7e9a7127-1c00-0000-1ea9-4e5c48060000 pid=1608 /usr/bin/sudo guuid=2f37db29-1c00-0000-1ea9-4e5c49060000 pid=1609 /tmp/sample.bin guuid=7e9a7127-1c00-0000-1ea9-4e5c48060000 pid=1608->guuid=2f37db29-1c00-0000-1ea9-4e5c49060000 pid=1609 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/da8070ca-f3e8-40b8-927b-341efd881e00
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1954450
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops files in suspicious directories
Drops invisible ELF files
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Tries to open /proc/mtd (commonly found in embedded devices)
Writes identical ELF files to multiple locations
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1954450 Sample: ntb.mips.elf Startdate: 08/08/2026 Architecture: LINUX Score: 100 66 169.254.169.254, 80 USDOS-USDepartmentofStateUS ZZ 2->66 68 85.11.167.183, 5060 COLOCATEL-INCColocatelNetwork-HighBandwidthDedicatedServersSC Netherlands 2->68 70 Malicious sample detected (through community Yara rule) 2->70 72 Antivirus detection for dropped file 2->72 74 Antivirus / Scanner detection for submitted sample 2->74 76 Multi AV Scanner detection for submitted file 2->76 11 ntb.mips.elf 2->11         started        14 systemd snapd-env-generator 2->14         started        16 systemd snapd-env-generator 2->16         started        18 9 other processes 2->18 signatures3 process4 signatures5 90 Found strings related to Crypto-Mining 11->90 20 ntb.mips.elf 11->20         started        process6 process7 22 ntb.mips.elf 20->22         started        file8 58 /var/spool/cron/crontabs/root, ASCII 22->58 dropped 60 /tmp/.sys, ELF 22->60 dropped 62 /root/.bashrc, ASCII 22->62 dropped 64 6 other malicious files 22->64 dropped 82 Sample tries to set files in /etc globally writable 22->82 84 Writes identical ELF files to multiple locations 22->84 86 Sample tries to persist itself using /etc/profile 22->86 88 7 other signatures 22->88 26 ntb.mips.elf sh 22->26         started        28 ntb.mips.elf sh 22->28         started        30 ntb.mips.elf sh 22->30         started        32 5 other processes 22->32 signatures9 process10 process11 34 sh at 26->34         started        38 sh 26->38         started        40 sh update-rc.d 28->40         started        42 sh syshelper 30->42         started        44 sh systemctl 32->44         started        46 sh systemctl 32->46         started        48 sh systemctl 32->48         started        file12 54 /var/spool/cron/atjobs/a0000101c641dd, POSIX 34->54 dropped 56 /var/spool/cron/atjobs/.SEQ, ASCII 34->56 dropped 78 Sample tries to persist itself using cron 34->78 80 Sample tries to persist itself using System V runlevels 40->80 50 update-rc.d systemctl 40->50         started        52 syshelper .sys 42->52         started        signatures13 process14
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2026-08-08 18:03:37 UTC
File Type:
ELF32 Big (Exe)
AV detection:
12 of 36 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l65mhb5sxkrevsahgy3on3fwnpstub2mdgri3icqrmzog7w743qa._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/260808-wmqzfswvf1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 01d31eb4fec94f20d367b61ea0a304023b68fefb2606452a684c2a8cf64ebb06

Mirai

elf 5fbac387b2baa24ac8073636e6ecb66be53a074c19a28da0508b32e37edfe6e0

(this sample)

  
Dropped by
SHA256 01d31eb4fec94f20d367b61ea0a304023b68fefb2606452a684c2a8cf64ebb06
  
URLhaus
https://urlhaus.abuse.ch/url/3899951/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 e04ffda528130d6aa90bc08689e313b8

Comments