MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9
SHA3-384 hash: 3eb57a7350d2661001db68ac3486dbc27cf9703591c5d3497f106be92178bfbaa72b466f524fe98419ae7382fdaf8559
SHA1 hash: ae0c8b7fd6f31ac18d0a30a5aec49885a583751c
MD5 hash: 5a22ad08de48b2ff0f74a1b0275ca6d4
humanhash: carbon-steak-cola-five
File name:x86
Download: download sample
Signature Mirai
Create hunting rule
File size:65'336 bytes
First seen:2025-12-26 01:15:26 UTC
Last seen:2025-12-26 17:14:17 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:EvqPkUoDq+On8f4ArAQf5NGcm9VbtMU2H3uNog0Jnouy8tyC:EvqPkUodFrZ5ocmH6pXua7Zoutz
TLSH T17853121AAB67D206E5CD44796DFE3B070046CA2718745AA5BECA400B8E35FFF9DB5403
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :65'336 bytes
File size (de-compressed) :162'888 bytes
Format:linux/i386
Unpacked file: 05ac8d0e7d5d0cfb71a8b5ef8fd879de60600bddfa2cf05f4fb36e865ea09b5a

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/dfc12539-9fe5-4db1-b085-305fab139800/
Detection(s):
Unix.Dropper.Mirai-7135858-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/694de1dea7163552ba04f7af/reports/bf618f89-d2f0-44b6-8bc2-3160abc1de16/overview
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2025-12-25T22:23:00Z UTC
Last seen:
2025-12-25T22:53:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.r HEUR:Backdoor.Linux.Mirai.cw HEUR:Backdoor.Linux.Mirai.b HEUR:Backdoor.Linux.Gafgyt.bl HEUR:Backdoor.Linux.Gafgyt.bj
Link:
https://opentip.kaspersky.com/65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c9ec8659-17a0-46a7-a172-b8bf9b57dd87
Behavior Graph:
Download SVG
%3 guuid=b75ae51b-1800-0000-bf5a-224918080000 pid=2072 /usr/bin/sudo guuid=7ea1ca1e-1800-0000-bf5a-22491b080000 pid=2075 /tmp/sample.bin net guuid=b75ae51b-1800-0000-bf5a-224918080000 pid=2072->guuid=7ea1ca1e-1800-0000-bf5a-22491b080000 pid=2075 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=7ea1ca1e-1800-0000-bf5a-22491b080000 pid=2075->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079 /tmp/sample.bin write-config write-file zombie guuid=7ea1ca1e-1800-0000-bf5a-22491b080000 pid=2075->guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079 clone guuid=ce8add1f-1800-0000-bf5a-224921080000 pid=2081 /usr/bin/dash guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=ce8add1f-1800-0000-bf5a-224921080000 pid=2081 execve guuid=d3774c21-1800-0000-bf5a-224926080000 pid=2086 /usr/bin/dash guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=d3774c21-1800-0000-bf5a-224926080000 pid=2086 execve guuid=f8238b82-1800-0000-bf5a-22492b090000 pid=2347 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=f8238b82-1800-0000-bf5a-22492b090000 pid=2347 clone guuid=a7e78f82-1800-0000-bf5a-22492c090000 pid=2348 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=a7e78f82-1800-0000-bf5a-22492c090000 pid=2348 clone guuid=8095a1ae-1900-0000-bf5a-2249a00b0000 pid=2976 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=8095a1ae-1900-0000-bf5a-2249a00b0000 pid=2976 clone guuid=2f0a20db-1a00-0000-bf5a-2249ae0d0000 pid=3502 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=2f0a20db-1a00-0000-bf5a-2249ae0d0000 pid=3502 clone guuid=84f15207-1c00-0000-bf5a-224956110000 pid=4438 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=84f15207-1c00-0000-bf5a-224956110000 pid=4438 clone guuid=08d0f333-1d00-0000-bf5a-224968140000 pid=5224 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=08d0f333-1d00-0000-bf5a-224968140000 pid=5224 clone guuid=d1f54161-1e00-0000-bf5a-224970140000 pid=5232 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=d1f54161-1e00-0000-bf5a-224970140000 pid=5232 clone guuid=45f0488e-1f00-0000-bf5a-224985140000 pid=5253 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=45f0488e-1f00-0000-bf5a-224985140000 pid=5253 clone guuid=8aa456bb-2000-0000-bf5a-224992140000 pid=5266 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=8aa456bb-2000-0000-bf5a-224992140000 pid=5266 clone guuid=de11eae8-2100-0000-bf5a-224993140000 pid=5267 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=de11eae8-2100-0000-bf5a-224993140000 pid=5267 clone guuid=b79c9316-2300-0000-bf5a-224994140000 pid=5268 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=b79c9316-2300-0000-bf5a-224994140000 pid=5268 clone guuid=584b9542-2400-0000-bf5a-224995140000 pid=5269 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=584b9542-2400-0000-bf5a-224995140000 pid=5269 clone guuid=60abd06f-2500-0000-bf5a-224996140000 pid=5270 /tmp/sample.bin guuid=d5fd951f-1800-0000-bf5a-22491f080000 pid=2079->guuid=60abd06f-2500-0000-bf5a-224996140000 pid=5270 clone guuid=97130620-1800-0000-bf5a-224922080000 pid=2082 /usr/bin/systemctl guuid=ce8add1f-1800-0000-bf5a-224921080000 pid=2081->guuid=97130620-1800-0000-bf5a-224922080000 pid=2082 execve guuid=991c7521-1800-0000-bf5a-224927080000 pid=2087 /usr/bin/systemctl guuid=d3774c21-1800-0000-bf5a-224926080000 pid=2086->guuid=991c7521-1800-0000-bf5a-224927080000 pid=2087 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/674a136e-9189-4634-a3f4-1c35e40f95be
Result
Threat name:
Gafgyt
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1839577
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Gafgyt
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1839577 Sample: x86.elf Startdate: 26/12/2025 Architecture: LINUX Score: 68 28 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Gafgyt 2->34 36 Sample is packed with UPX 2->36 9 x86.elf 2->9         started        signatures3 process4 process5 11 x86.elf 9->11         started        file6 26 /usr/local/bin/infinitd, ELF 11->26 dropped 14 x86.elf sh 11->14         started        16 x86.elf sh 11->16         started        18 x86.elf 11->18         started        20 24 other processes 11->20 process7 process8 22 sh systemctl 14->22         started        24 sh systemctl 16->24         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-26 01:16:17 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mvyrvi3opzy5h3m6wcrydval5llpk2vzseuuaicnx7d7mzfm6w4q._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet discovery linux persistence privilege_escalation upx
Link:
https://tria.ge/reports/251226-bmwjqawqhj/
Behaviour
Reads runtime system information
Changes its process name
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
Modifies systemd
Write file to user bin folder
Mirai
Mirai family
Malware Config
C2 Extraction:
teamc2.duckdns.org
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135858-0
YARA:
n/a
Link:
https://app.threat.zone/submission/5d084abf-f6a9-459f-99ae-a1bf09d6a958
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 65711aa36e7e71d3ed9eb0a381d40bead6f56ab9912940204dbfc7f664acf5b9

(this sample)

Mirai

elf 05ac8d0e7d5d0cfb71a8b5ef8fd879de60600bddfa2cf05f4fb36e865ea09b5a

  
URLhaus
https://urlhaus.abuse.ch/url/3722799/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 05ac8d0e7d5d0cfb71a8b5ef8fd879de60600bddfa2cf05f4fb36e865ea09b5a
  
Dropping
MD5 6743a3a062b3be4518a8d55b6365adc3

Comments