MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60604b6f5513043f1992a100c7f50cc99959b265d7acd1e00d68ba107bd9b8f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	60604b6f5513043f1992a100c7f50cc99959b265d7acd1e00d68ba107bd9b8f8
SHA3-384 hash:	9c37965aa644da84d459d27272380375bd9b5b7a0885200114655ffd232ee35a167a49b51da827b69031f4c28bd869a5
SHA1 hash:	6e75d26b50a7fcda8529b56115bcf1f256c30da7
MD5 hash:	b43aa7b34ca60d129fac5255cb4e0f41
humanhash:	happy-texas-high-crazy
File name:	mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	198'764 bytes
First seen:	2025-12-24 15:33:32 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:1aOz4o/JPTGBqm4MXMLyn0EUfftxpsJHwopozuMwfak:1ayJP8P4MXMLQaPpsSH6h
TLSH	T1DC143B0BB7118FA1C368D67009B3CA67D7E625921AE19986E76DDD007A7075C3C3FEA0
telfhash	t1d2b0012035b48bf68108e96980ecaf6989f21ddb1d532c5bdb402c764bb28434f10d28
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 ba652269dbd98042396f8089e9027bde5e9f9f522ff6649f1e13d0891d58756c

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	71'956 bytes
File size (de-compressed) :	198'764 bytes
Format:	linux/mips
Packed file:	ba652269dbd98042396f8089e9027bde5e9f9f522ff6649f1e13d0891d58756c

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/42253efe-fbc4-4ca5-84d1-1e9dafac0f16

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b6dddf89-43a6-44bb-8bb4-70887fce2524

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1838908

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/60604b6f5513043f1992a100c7f50cc99959b265d7acd1e00d68ba107bd9b8f8

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/60604b6f5513043f1992a100c7f50cc99959b265d7acd1e00d68ba107bd9b8f8/

Threat name:

Linux.Trojan.Gafgyt

Status:

Suspicious

First seen:

2025-12-24 15:34:39 UTC

File Type:

ELF32 Big (Exe)

AV detection:

4 of 36 (11.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mbqew32vcmcd6gmsueamp5imzgmvtmtf26wndyannc5ba66zxd4a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery

Link:

https://tria.ge/reports/251224-szk27afz9a/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

Deletes Audit logs

Deletes system logs

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ba2f6ca0-7c27-4182-8d8a-e40e649473e7

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.