MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157
SHA3-384 hash: 8176bb7edb6b30777981b66c53bd428075741a7982a24d8b441ccf53da029a80c200d92d5a920b3cff3e90fe1ee0b3b9
SHA1 hash: f828a0843d48fd605b5d85ca52be1935159ffadd
MD5 hash: be2fae5f281c9060219f3d4b4bec974d
humanhash: salami-carpet-twelve-timing
File name:morte.arm6
Download: download sample
Signature Mirai
Create hunting rule
File size:42'868 bytes
First seen:2025-06-26 22:46:27 UTC
Last seen:2025-06-27 00:25:20 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:t3gkM1q6f00ws1G6tF/DBNiQgU8pD9rd3sugWn3a4k3mvQV3kvfHR9q3UEL+e:to1iXsbbBoQS5BBgWnfoLOcL7
TLSH T1C913023497D34430FE245075E8E509C21981AFACD5DF2997226AFE58678B05B8FD940F
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :42'868 bytes
File size (de-compressed) :95'708 bytes
Format:linux/arm
Unpacked file: 68fe557136bf076e36a8d6b6e19678472e82b9f496da38d45313055a77512995

Intelligence

File Origin
# of uploads :
3
# of downloads :
106
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9999.3538.3874.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685dcdca32ed47a3a8d7aadalinux22vpnfull_triage
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/685dce01d1f1eb5d81c7b2f7/reports/cd13e221-700c-445b-a3e3-d6c8700e17c0/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b5a104c3-f18a-4c7f-a15b-27a9e894b0ea
Behavior Graph:
Download SVG
%3 guuid=2a6f7344-1800-0000-6f34-1ba5c8090000 pid=2504 /usr/bin/sudo guuid=cba55846-1800-0000-6f34-1ba5d0090000 pid=2512 /tmp/sample.bin guuid=2a6f7344-1800-0000-6f34-1ba5c8090000 pid=2504->guuid=cba55846-1800-0000-6f34-1ba5d0090000 pid=2512 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5eaf2da-42ac-4a1e-a27e-c9f161084928
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1723864
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-06-26 22:47:23 UTC
File Type:
ELF32 Little (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nn364yo2ckmhz4lagdi5vhf4vbepjmvxfn3or3vgpho64ysymflq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet discovery upx
Link:
https://tria.ge/reports/250626-2qptfswrz6/
Behaviour
Reads runtime system information
Mirai
Mirai family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/129187c3-2f16-4660-8229-d9fa00262a30
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157

(this sample)

Mirai

elf 68fe557136bf076e36a8d6b6e19678472e82b9f496da38d45313055a77512995

  
URLhaus
https://urlhaus.abuse.ch/url/3570532/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3570542/
  
Dropping
SHA256 68fe557136bf076e36a8d6b6e19678472e82b9f496da38d45313055a77512995
  
Dropping
MD5 ddfefc29f6de39d777d4d4f57ef57aa6

Comments