MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b
SHA3-384 hash:	b9e7ca97b83a47c969c04d8573792e8feafd022fa566032c3fd0cdbd3bcca17702bb87d3fb57d07a9f2643560b4739b4
SHA1 hash:	ee30e81866bb37e3bc43a3f9936414499f9949f9
MD5 hash:	452f5055bdb987b2ea8df9d2d0238138
humanhash:	spaghetti-two-tennessee-monkey
File name:	mpsl
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	92'512 bytes
First seen:	2025-11-30 00:32:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:a5DnSB+v5djQm2X17xk49d6xZLu8vJ4TGo8S:a5TSB+v5djQmq1GFrvhrS
TLSH	T11E93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29504.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7136015-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9876194-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10017641-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Receives data from a server

Opens a port

Sends data to a server

Connection attempt

Substitutes an application name

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

exploit mirai

Link:

https://www.filescan.io/uploads/692b90cb1b65ca0bb927a6b6/reports/ab1a4851-499a-4040-8067-3e96eed2bd22/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

7

Number of processes launched:

1

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-29T16:46:00Z UTC

Last seen:

2025-11-29T19:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/616a852c-8519-4d82-bdb9-6ca27e1e2b2b

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/020ce52e-2001-4e86-bb53-e0b4b787dbe5

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1822935

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/69e83aa53811f6116a5a8da6be214f2f24fecbed3c53662ee7d2fb9c7138119b/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-29 23:49:28 UTC

File Type:

ELF32 Little (Exe)

AV detection:

23 of 36 (63.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhudvjjych3bc2s2rwtl4ikpf4sp5s7nhrjwmlxh2l5zy4jycgnq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:wicked credential_access defense_evasion discovery

Link:

https://tria.ge/reports/251130-awa4psdj7s/

Behaviour

Changes its process name

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Modifies Watchdog functionality

Contacts a large (85835) amount of remote hosts

Creates a large amount of network flows

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7136015-0

YARA:

n/a

Link:

https://app.threat.zone/submission/8781cc1a-8925-477d-b35e-49e70be27c69

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.