MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b
SHA3-384 hash: a5721b5d93b360a2ba38563c080f43bead9f98aac80fae7135f414e32b836bac48abd9a240a2050bed747a029c1a519d
SHA1 hash: 906cf4b46275592d37bf0bf2b6987623810c01eb
MD5 hash: e153bf71ba51ee57ab2827354b17b130
humanhash: sad-beryllium-ink-fifteen
File name:ecco.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:248'864 bytes
First seen:2025-12-04 21:18:38 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:u6HfT1nH3bvccszsHdARsk1n4HhQueBwQ7D:uEThNMsi4HGhv
TLSH T107342985FC919E26C6C512B7FA6F028D371A13F9E2EA3102DD251F60378A95F0D3B685
telfhash t1e6512c51de89196cb3d754c8d9bef136dab833a95b0930068b1cf73a9e839c1b46d813
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 b3f5d6f349c123f71787e5c68203f6f287932a971fec2f99dc7815cb17e9abfd
File size (compressed) :82'272 bytes
File size (de-compressed) :248'864 bytes
Format:linux/arm
Packed file: b3f5d6f349c123f71787e5c68203f6f287932a971fec2f99dc7815cb17e9abfd

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Link:
https://research.acce.ciphertechsolutions.com/results/e72435d6-0d69-4680-a84b-b09abf6dd6e9/
Detection(s):
Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29524.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30395.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30435.LC.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Siggen.9999-6.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29001.LCM.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-7100807-0
Create hunting rule

Unix.Dropper.Mirai-7135870-0
Create hunting rule

Unix.Dropper.Mirai-7135881-0
Create hunting rule

Unix.Dropper.Mirai-7135897-0
Create hunting rule

Unix.Dropper.Mirai-7135901-0
Create hunting rule

Unix.Dropper.Mirai-7135909-0
Create hunting rule

Unix.Trojan.Mirai-7135916-0
Create hunting rule

Unix.Dropper.Mirai-7135918-0
Create hunting rule

Unix.Dropper.Mirai-7135954-0
Create hunting rule

Unix.Dropper.Mirai-7135996-0
Create hunting rule

Unix.Dropper.Mirai-7136013-0
Create hunting rule

Unix.Dropper.Mirai-7136016-0
Create hunting rule

Unix.Dropper.Mirai-7136017-0
Create hunting rule

Unix.Dropper.Mirai-7136028-0
Create hunting rule

Unix.Dropper.Mirai-7136033-0
Create hunting rule

Unix.Dropper.Mirai-7136057-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

Unix.Trojan.Mirai-9441505-0
Create hunting rule

Unix.Trojan.Mirai-9807962-0
Create hunting rule

Unix.Trojan.Mirai-9808381-0
Create hunting rule

Unix.Trojan.Mirai-9858729-0
Create hunting rule

Unix.Dropper.Mirai-9977145-0
Create hunting rule

Unix.Dropper.Mirai-10007027-0
Create hunting rule

Unix.Trojan.Mirai-10009361-0
Create hunting rule

Unix.Trojan.Mirai-10011027-0
Create hunting rule

Unix.Trojan.Mirai-10011918-0
Create hunting rule

Unix.Trojan.Mirai-10058414-0
Create hunting rule

Unix.Packed.Botnet-6566031-0
Create hunting rule

Unix.Dropper.Botnet-6566040-0
Create hunting rule

Unix.Trojan.Gafgyt-6748839-0
Create hunting rule

Verdict:
Malicious
File Type:
elf.32.le
First seen:
2025-12-04T17:33:00Z UTC
Last seen:
2025-12-04T19:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b/results?tab=lookup
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/667990d6-a860-42df-9384-680abea2fa7d
Result
Threat name:
Mirai, Gafgyt
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1826814
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Detected Mirai
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Malicious sample detected (through community Yara rule)
Manipulation of devices in /dev
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Suricata IDS alerts for network traffic
Uses known network protocols on non-standard ports
Yara detected Gafgyt
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1826814 Sample: ecco.arm.elf Startdate: 04/12/2025 Architecture: LINUX Score: 100 79 66.104.114.181 XO-AS15US United States 2->79 81 184.49.234.97, 23 WAYPORTUS United States 2->81 83 98 other IPs or domains 2->83 91 Suricata IDS alerts for network traffic 2->91 93 Malicious sample detected (through community Yara rule) 2->93 95 Antivirus detection for dropped file 2->95 97 6 other signatures 2->97 12 ecco.arm.elf 2->12         started        signatures3 process4 process5 14 ecco.arm.elf 12->14         started        process6 16 ecco.arm.elf 14->16         started        file7 69 /etc/init.d/sysd, POSIX 16->69 dropped 85 Sample tries to set files in /etc globally writable 16->85 87 Drops files in suspicious directories 16->87 89 Sample tries to persist itself using System V runlevels 16->89 20 ecco.arm.elf 16->20         started        22 ecco.arm.elf 16->22         started        25 ecco.arm.elf sh 16->25         started        signatures8 process9 file10 27 ecco.arm.elf 20->27         started        29 ecco.arm.elf sh 20->29         started        31 ecco.arm.elf 20->31         started        39 4 other processes 20->39 71 /usr/Bin), ELF 22->71 dropped 33 ecco.arm.elf 22->33         started        35 ecco.arm.elf sh 22->35         started        37 sh cp 25->37         started        process11 signatures12 56 749 other processes 27->56 42 sh crontab 29->42         started        46 sh 29->46         started        48 ecco.arm.elf 31->48         started        58 3 other processes 31->58 60 239 other processes 33->60 50 sh crontab 35->50         started        52 sh 35->52         started        99 Manipulation of devices in /dev 39->99 54 ecco.arm.elf 39->54         started        process13 file14 73 /var/spool/cron/crontabs/tmp.DCEqSJ, ASCII 42->73 dropped 62 sh crontab 46->62         started        101 Deletes system log files 48->101 75 /var/spool/cron/cr...mp.HKQFvg (deleted), ASCII 50->75 dropped 77 /dev/null (deleted), ASCII 50->77 dropped 103 Manipulation of devices in /dev 50->103 105 Sample tries to persist itself using cron 50->105 107 Executes the "crontab" command typically for achieving persistence 50->107 65 sh crontab 52->65         started        67 ecco.arm.elf 58->67         started        signatures15 process16 signatures17 109 Executes the "crontab" command typically for achieving persistence 62->109
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-12-04 21:19:27 UTC
File Type:
ELF32 Little (Exe)
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=miasc4n6iz2qb4wxewpeu5pti6dy6clpblu4klkhkikxe7fj54fq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd
Link:
https://tria.ge/reports/251204-z6ay5ael21/
Malware Config
C2 Extraction:
draft22.redirectme.net
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Trojan.Mirai-7100807-0
YARA:
Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024
Link:
https://app.threat.zone/submission/ca708aaf-46f4-4203-9288-ee188f2cfee0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CVE_2017_17215
Create hunting rule
Author:NDA0E
Description:Detects exploitation attempt of CVE-2017-17215
Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:iot_req_metachar
Create hunting rule
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Generic_Threat_1ac392ca
Create hunting rule
Author:Elastic Security
Rule name:Linux_Generic_Threat_d94e1020
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b3f5d6f349c123f71787e5c68203f6f287932a971fec2f99dc7815cb17e9abfd

Mirai

elf 62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b

(this sample)

  
Dropped by
SHA256 b3f5d6f349c123f71787e5c68203f6f287932a971fec2f99dc7815cb17e9abfd
  
URLhaus
https://urlhaus.abuse.ch/url/3725559/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 9265a0e76c998ebd7ffb6fc8348bdc4b

Comments