MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca
SHA3-384 hash: 69548566073f4273f52ae7c93fd60cb310e08b92b9852157b9749d5d1ef01e7a3da05fd5740409f4c8b2d5cc1622a6ca
SHA1 hash: ce02ba9cbe8aafdae3c27914b037c14868857dc5
MD5 hash: be3579e1972e14ef7b6252b8e7dc1438
humanhash: idaho-bluebird-glucose-montana
File name:dlr.arm7
Download: download sample
Signature Mirai
Create hunting rule
File size:1'624 bytes
First seen:2025-12-06 07:28:39 UTC
Last seen:2025-12-06 09:24:10 UTC
File type: elf
MIME type:application/x-executable
ssdeep 48:mcJKGJZ2oNi/YqCpFaFaX8o3ABubLAS4:mcJKQ2KFaFWfAlS4
TLSH T1D83131C1B3E11D6CD4E051BE8C4B0F18F3399F80D2E37123920C3328AD2AE785E2A465
telfhash t1b8a00221cf9fd484d1a0075148a091069de0cb0b04000ce2b0ca0c54852264075b1188
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.523.23494.31215.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
elf.32.le
First seen:
2025-12-06T06:30:00Z UTC
Last seen:
2025-12-07T18:08:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Linux.Mirai.d
Link:
https://opentip.kaspersky.com/640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40f436a0-860b-486f-8e59-d6210c1c115c
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1827864
Signature
Contains symbols with names commonly found in malware
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1827864 Sample: dlr.arm7.elf Startdate: 06/12/2025 Architecture: LINUX Score: 60 31 169.254.169.254, 80 USDOSUS Reserved 2->31 33 perferctdmng.is 45.8.93.146, 2113, 54290 TING-WIRELESSUS Germany 2->33 35 3 other IPs or domains 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Mirai 2->39 41 Contains symbols with names commonly found in malware 2->41 8 dlr.arm7.elf Hari 2->8         started        11 python3.8 dpkg 2->11         started        13 bash ld-linux.so.2 2->13         started        signatures3 process4 file5 29 /tmp/Hari, ELF 8->29 dropped 15 Hari 8->15         started        17 Hari 8->17         started        19 Hari 8->19         started        process6 process7 21 Hari iptables 15->21         started        23 Hari iptables 15->23         started        25 Hari iptables 15->25         started        27 30 other processes 15->27
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca/
Verdict:
Malicious
Threat:
Trojan-Downloader.Linux.Mirai
Link:
https://tip.neiki.dev/file/640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-06 07:15:15 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mqcxk2lmyzu577im23u54e2clcaso6goidmb7q5hkya7jduillfa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251206-jbee3azlcp/
Behaviour
Writes file to tmp directory
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d042545f-a2c8-4b2c-9a1c-8b1cd6968d53
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3726976/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3727005/
  
URLhaus
https://urlhaus.abuse.ch/url/3727737/

Comments