MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f
SHA3-384 hash:	ede48836704ef1c18be6994d68468011401896887c8bad61b029067b83bc075bb99326dc659f1a7a920abae88f6f70d9
SHA1 hash:	dff81d91f7429dda637e211252608ad972e4a151
MD5 hash:	cbf2a45289b93f62eaa4dfd4b3ea7643
humanhash:	twenty-venus-louisiana-maine
File name:	x86_64
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	89'736 bytes
First seen:	2025-12-17 13:12:46 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:0DFQ8rwo9Y1JaUWfm/NvXEGW11tfy6RgVIIcA+t6RztCiEdeWMdqw1Xoe9R9Cr:AQIwo9saUAg99O5cc2RzIiEUfjoMRI
TLSH	T1CB93F803F5C689FDC04AC1306F5FA43ADA34F99D12387A6B1B84FF21296EE315A4D649
telfhash	t1e6216a7068d6196050d7e131f357faf4d9222f712af135a4ca7b5ce2cf2a7c44d95016
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

45

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Siggen.9999-11.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Kills processes

Sends data to a server

Runs as daemon

Opens a port

DNS request

Substitutes an application name

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6942ac6a3f8fdbf8e9496332/reports/c396a21b-13fb-48c8-99e1-2ef858d6b564/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2025-12-17T11:35:00Z UTC

Last seen:

2025-12-18T00:39:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Linux.Mirai.b

Link:

https://opentip.kaspersky.com/6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ebd79fea-4707-4342-8e4f-19bf5a7df970

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b836a070-5bc3-401d-94a2-fc1c60f07692

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1834794

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f/

Neiki Family.Mirai

Verdict:

Malicious

Threat:

Family.Mirai

Link:

https://tip.neiki.dev/file/6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-17 13:13:16 UTC

File Type:

ELF64 Little (Exe)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nxfhb3exenybybjdfdwwxiklrhn6pdm32koc4n6bv5zmwqrlib7q._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai defense_evasion discovery linux

Link:

https://tria.ge/reports/251217-qf6tfafp5y/

Behaviour

Reads runtime system information

Changes its process name

Enumerates running processes

Writes file to system bin folder

Modifies Watchdog functionality

Threat.Zone Malicious

Verdict:

Malicious

Tags:

trojan mirai

YARA:

Linux_Trojan_Mirai_564b8eda

Link:

https://app.threat.zone/submission/dc5d10db-4710-411b-9840-fb1967e86b15

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6dca70ec9723701c052328ed6ba14b89dbe78d9bd29c2e37c1af72cb422b407f