MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57
SHA3-384 hash:	eeae12ff88057a8f27f0f49627a8dd5a9a4c0764fccd17c787d1628adcc39e14b095a8b5ec654ebebdca95e87c99697f
SHA1 hash:	1f6cda2f25a6fd05a46119ef7e2ec44ef3266953
MD5 hash:	408ed1473ff73b28f3c271f4e26f56cc
humanhash:	oven-don-mountain-shade
File name:	x86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	78'960 bytes
First seen:	2026-06-01 07:31:09 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:SfJDI3vVWqcRAhJtz+Z57UiGKUEhCUKClK8qkJfHvDEdReedSWE+:2JD89WpRglI7UBKUHwVfHLskeh3
TLSH	T1FA735BC5A743D0F0EC521675447BA3528E76E4365639FF56E7AA3A32AC03B009E1B39C
telfhash	t1e231c5fa4e7e09e87350ac45c20a2e65394aa77718603ae74233d87532efe46547bd38
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Gafgyt-9940653-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9951089-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sends data to a server

Creating a file

Opens a port

Receives data from a server

DNS request

Runs as daemon

Substitutes an application name

Performs a bruteforce attack in the network

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a1d354d099ef368af125fb1/reports/6597f6e7-9e6c-42d8-8382-de4f08bf4e5c/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ELF 32 LE

Detections:

HEUR:Backdoor.Linux.Mirai.lt

Link:

https://opentip.kaspersky.com/61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/fc91d686-f74f-41f1-a395-dcd90265f014

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/950182c4-d06b-460b-af86-edbe572bfc2b

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-01 07:31:43 UTC

File Type:

ELF32 Little (Exe)

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mf4qw3fcryxnjcj7vegh2k6yvguhd6z7dsjp36xlclr5vdaszvlq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260601-jclwjagx3k/

Behaviour

Changes its process name

Contacts a large (26485) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.