MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7
SHA3-384 hash: 207f062b75e774dc2551e9a7ca6259ceed582891edad84bda27cddabdfee8ab8c58ef4039b5aa39e0dec8c8e2218c448
SHA1 hash: 301e285a4942c5070880dcb5aa764805b01653c3
MD5 hash: a47c05ddc03ea80f28d1dac1a9d8e80f
humanhash: autumn-jersey-spaghetti-california
File name:arm6
Download: download sample
Signature Mirai
Create hunting rule
File size:109'088 bytes
First seen:2025-12-08 06:49:48 UTC
Last seen:2025-12-08 08:43:02 UTC
File type: elf
MIME type:application/x-executable
ssdeep 3072:wJbzywNbPro+j9IhJsFUgmwRisaGpSUlYrh4q3t5NMM:wRuwNbPE+JIhyFUgmwRDabJrhxt5NMM
TLSH T1ABB32846B8819F25C6D613BAFE1E128E332327B8D3EEB212DC145F24778652B0E77512
telfhash t139f0c072c95854ec9bec248811df12496dac75f6263f741099ee4e0f56030c0f83113b
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Mirai.9697.31379.25152.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
expand lolbin rust
Link:
https://www.filescan.io/uploads/69367537bba50eaf04263749/reports/2e685db7-72ab-48fb-8390-69e2d12f491d/overview
Result
Gathering data
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6db63406-7502-4c6c-ae8f-15a7e43cc8c2
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1828612
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-08 06:50:30 UTC
File Type:
ELF32 Little (Exe)
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtnzgi5jx4hrq5ymcnhdso7bvqpbeodibqcqdbel3cxokiqb2l3q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/251208-hl5vbsspbn/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/28da3b85-ebe6-4dfd-a5c5-63c4038cdbd4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 64db9323a9bf0f18770c134e393be1ac1e1238680c0501848bd8aee52201d2f7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3729111/
  
Delivery method
Distributed via web download

Comments