MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 15

Intelligence 15 IOCs YARA 10 File information Comments

SHA256 hash:	6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812
SHA3-384 hash:	cf8b556fecdb7eecb694a0621138c2e5202ee0b291fdf291f5373676b1569ca2b440fc53682450328e26b061e9ca9313
SHA1 hash:	c9abfafbedb8b7fb90c51b34e3806bd84a21a3cb
MD5 hash:	63e57862d47c867f90e5b53685da5f57
humanhash:	shade-kentucky-emma-illinois
File name:	terrariaupdate.exe.old
Download:	download sample
Signature	Mirai Create hunting rule
File size:	10'781'003 bytes
First seen:	2025-07-25 06:51:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ffb273f107ecdfd0776396647ec297d9 (1 x Mirai)
ssdeep	196608:MPArkDyNPku6UeSYJQIrh4FP80MQEfl2f+qgS/962:MPQaEsukSYiIrh4FPPKYf+WR
TLSH	T172B6CF0179B8B1A6D0C1087734E75E7A25B1DE2148E68A352F26DFFD8C224BBC847ED5
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	f078eedeb6cce461 (1 x Mirai)
Reporter	juroots
Tags:	CoinMiner exe mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

xmrig

ID:

File name:

terrariaupdate.exe

Verdict:

Malicious activity

Analysis date:

2025-07-18 09:38:01 UTC

Tags:

miner xmrig

Link:

https://app.any.run/tasks/0b77bb86-edc9-433a-a90d-2acd87936f68

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CoinMiner02

Link:

https://www.capesandbox.com/analysis/16738/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6883297caf3050dc8d30b3be

Tags:

dropper xmrig crypt virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a process from a recently created file

Searching for synchronization primitives

DNS request

Connecting to a cryptocurrency mining pool

Connection attempt

Sending a custom TCP request

Creating a service

Launching a service

Loading a system driver

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug evasive obfuscated overlay packed packed packer_detected

Link:

https://www.filescan.io/uploads/68832974a5898ad60467c60d/reports/de40b5f8-ea8c-429e-96b4-e7d9f432bb44/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1c013864-896b-4355-94dc-9d115d6eb938

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 64 Exe x64

Link:

https://app.malva.re/file/63e57862d47c867f90e5b53685da5f57

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812/

Threat name:

Win64.PUA.Generic

Status:

Suspicious

First seen:

2025-07-17 14:55:38 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mjd2wea6lzfvdyj5lw66m56zarekkit2zjhfax2be7xvyp5chaja._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner persistence

Link:

https://tria.ge/reports/250725-hmqf2aam51/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Adds Run key to start application

Executes dropped EXE

XMRig Miner payload

Xmrig family

xmrig

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/206c1815-3131-4e82-a4fc-c3c8c928002b

Unpacked files

SH256 hash:

6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812

MD5 hash:

63e57862d47c867f90e5b53685da5f57

SHA1 hash:

c9abfafbedb8b7fb90c51b34e3806bd84a21a3cb

Link:

https://www.unpac.me/results/d5b1d129-8c98-41df-9fe9-8fe9b180db99/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

exe 6247ab101e5e4b51e13d5dbde677d90448a5227aca4e505f4127ef5c3fa23812

(this sample)

Cape

https://www.capesandbox.com/analysis/16738/

URLhaus

https://urlhaus.abuse.ch/url/3589598/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high
CHECK_TRUST_INFO	Requires Elevated Execution (uiAccess:None)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::GetConsoleWindow
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample