MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e
SHA3-384 hash:	afeabf0df56f913aae89fb311d3b094fc69788231d6359024c9860a477bc5e14374cf1c5b4ce9a187bae96c476df59e6
SHA1 hash:	18e006a1221442420dcc82eb5b19f77c5f033786
MD5 hash:	fda598aef75b92613a6e4b360e694e54
humanhash:	seventeen-yankee-maryland-saturn
File name:	Josho.spc
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	60'116 bytes
First seen:	2025-12-23 22:57:19 UTC
Last seen:	2025-12-24 09:02:20 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:TXon00+q9wp3C+vactfa1sDHQYAzsv6WswWSHoXdss63B/9JO+zC3b:TXw00+SY3CaactfI6Qvzsv6vwcGJg
TLSH	T1C2432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

70

Origin country :

DE

Vendor Threat Intelligence

ACCE Mirai_Botnet_XOR_Lookup

Malware configuration found for:

Mirai

Details

Mirai

an XOR decryption key and at least a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/71e30e93-6c2c-4f9b-b9bf-51277427178d/

ClamAV Detected

Detection(s):

Unix.Dropper.Mirai-7135890-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135939-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7136025-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

gafgyt masquerade mirai

Link:

https://www.filescan.io/uploads/694b1e883f8fdbf8e9507cac/reports/424aed2b-99bb-4ccf-9bb1-22cf3a62a7cf/overview

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.be

Detections:

HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b

Link:

https://opentip.kaspersky.com/6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8559cb1e-db27-417e-87e1-0ee76772939b

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/165885ed-ca50-4da1-abbb-da3e67a73b2b

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1838543

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-23 13:34:40 UTC

File Type:

ELF32 Big (Exe)

AV detection:

23 of 36 (63.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nqkblm5uf4rkillanmisiodnxk5bki445f7he4f7yaihpwdt5wpa._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:josho linux

Link:

https://tria.ge/reports/251223-2xextsxmaz/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135890-0

YARA:

n/a

Link:

https://app.threat.zone/submission/365e946e-4ab2-4bcb-971c-63af5a145166

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6c1415b3b42f22a42d606b1124386dbaba15239ce97e7270bfc01077d873ed9e