MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1e482aa6b1ac792ab1ddaa2a395d758e098259fb9febc9b86828ef0fa9e671. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	6c1e482aa6b1ac792ab1ddaa2a395d758e098259fb9febc9b86828ef0fa9e671
SHA3-384 hash:	6d040fb19a55b9b76fe077aa063869705708cb627559d3fea3e7d1ea86ede077084c2dad2fe5cb6310688c3bc18c5dfb
SHA1 hash:	500f1cecefff7dd937890821a9223a9724be314a
MD5 hash:	be10b7170604a70184b3325aa14276bb
humanhash:	spring-sweet-bravo-chicken
File name:	debug
Download:	download sample
Signature	Mirai Create hunting rule
File size:	41'832 bytes
First seen:	2025-12-08 12:22:48 UTC
Last seen:	2025-12-08 20:19:54 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:wzDT+5mfT/P0B42qES1B0R8yc+6yzEoXRqyfnbcuyD7UHQRjHu:wa5E2lSYR8ZaVTnouy8Hyy
TLSH	T1C813F16E633C0B16D7BEBC3551DEA9662484870ED25588F9EE82B2E13902F08753D1F7
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	juroots
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	41'832 bytes
File size (de-compressed) :	87'316 bytes
Format:	linux/i386
Unpacked file:	14eb36fd1fa9c1ab806764582c1e0bb73717a363fd4f30339f85d329ca01e8e8

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e52057e0-a238-4747-befb-eb379b5f2a32/

Detection(s):

Unix.Dropper.Mirai-7135858-0

Result

Gathering data

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8891d3e5-f855-4cac-aeca-6a68fd59e911

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6c1e482aa6b1ac792ab1ddaa2a395d758e098259fb9febc9b86828ef0fa9e671

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c1e482aa6b1ac792ab1ddaa2a395d758e098259fb9febc9b86828ef0fa9e671/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-12-08 12:23:29 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 36 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nqpeqkvgwgwhskvr3wvcuok5owhatasz7op6xsnynauo6d5j4zyq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251208-pknb8adw7h/

Behaviour

Reads runtime system information

Enumerates running processes

Writes file to system bin folder

Modifies Watchdog functionality

Mirai

Mirai family

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135858-0

YARA:

n/a

Link:

https://app.threat.zone/submission/fbb3b6fd-1169-4033-bb73-8862d869a855

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.74

Link:

https://yomi.yoroi.company/submissions/6c1e482aa6b1ac792ab1ddaa2a395d758e098259fb9febc9b86828ef0fa9e671

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research