MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0
SHA3-384 hash: 12151834a63d2d70fb780cc1424ba197f31ed789e8959e63b2e011ee5dfb1a34fb9845bd8b194d1180ec13d09ddd6be1
SHA1 hash: 29d2489002e0c722e75d53542604c7baad9e921a
MD5 hash: 0be93c629d58e7cf32e6145c000a1e04
humanhash: north-magazine-neptune-romeo
File name:abba.m68k
Download: download sample
Signature Mirai
Create hunting rule
File size:51'952 bytes
First seen:2025-09-06 06:23:56 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:XOeOdnyqr6+H7VhCFf4lZeevLRD6VMuR7SsOJJadw9/QtgY8ql:e7dnLr6a7zAVMuBSdJadw9Qtx8a
TLSH T112332ADAF5029E7DF88FE6BA80664E09F631231050930B2677A7FDD37E320949D52E46
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-6981989-0
Create hunting rule

Unix.Dropper.Mirai-7135890-0
Create hunting rule

Unix.Dropper.Mirai-7135939-0
Create hunting rule

Unix.Dropper.Mirai-7136025-0
Create hunting rule

Unix.Trojan.Mirai-9940650-0
Create hunting rule

Unix.Trojan.Mirai-10018298-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/68bbd3f5822d8c77dc6438e4/reports/07787d9d-8ce8-4c00-80b0-7ad3511985d3/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-09-06T03:32:00Z UTC
Last seen:
2025-09-06T03:32:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b
Link:
https://opentip.kaspersky.com/6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3555573f-d29a-4aad-96da-1a76d776af3c
Behavior Graph:
Download SVG
%3 guuid=f9947c83-1800-0000-6596-bd7ba80d0000 pid=3496 /usr/bin/sudo guuid=9511c785-1800-0000-6596-bd7bac0d0000 pid=3500 /tmp/sample.bin guuid=f9947c83-1800-0000-6596-bd7ba80d0000 pid=3496->guuid=9511c785-1800-0000-6596-bd7bac0d0000 pid=3500 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/50f48bc3-0875-4d0a-9013-4c703d946a1f
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1772229
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1772229 Sample: abba.m68k.elf Startdate: 06/09/2025 Architecture: LINUX Score: 60 44 154.65.220.108 movicel-asAO Angola 2->44 46 188.102.19.178 VODANETInternationalIP-BackboneofVodafoneDE Germany 2->46 48 99 other IPs or domains 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Uses known network protocols on non-standard ports 2->54 10 abba.m68k.elf 2->10         started        12 python3.8 dpkg 2->12         started        signatures3 process4 process5 14 abba.m68k.elf 10->14         started        16 abba.m68k.elf 10->16         started        18 abba.m68k.elf 10->18         started        process6 20 abba.m68k.elf 14->20         started        22 abba.m68k.elf 14->22         started        24 abba.m68k.elf 16->24         started        26 abba.m68k.elf 16->26         started        28 abba.m68k.elf 16->28         started        process7 30 abba.m68k.elf 20->30         started        32 abba.m68k.elf 20->32         started        34 abba.m68k.elf 20->34         started        36 abba.m68k.elf 24->36         started        38 abba.m68k.elf 24->38         started        process8 40 abba.m68k.elf 30->40         started        42 abba.m68k.elf 30->42         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-09-06 06:28:39 UTC
File Type:
ELF32 Big (Exe)
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nnwgqk5sgauhbq3cegywizlie73ou5wpygkwybmd2d33o4rmigya._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:owari linux
Link:
https://tria.ge/reports/250906-g66rpaaj4z/
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-6981989-0
YARA:
n/a
Link:
https://app.threat.zone/submission/cad3a238-3bb3-4642-ac46-46f14f20935d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 6b6c682bb2302870c36221b164656827f6ea76cfc1956c0583d0f7b7722c41b0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3618279/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3618292/
  
URLhaus
https://urlhaus.abuse.ch/url/3618916/

Comments