MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee29731be3f52a6c4128b16f775a2bb0c605c48189cca5b73027df120c25f01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	6ee29731be3f52a6c4128b16f775a2bb0c605c48189cca5b73027df120c25f01
SHA3-384 hash:	fde6950d10ef3d7d9a3ca3b4f762f6c6fa9cd6b4020c614fbf53320ca363410b1d568f346a48ce80efb4b719b3d48912
SHA1 hash:	bab6cd8356e19599fd657166643db7c0319361b5
MD5 hash:	79582313f6d83b0edc163bc22d36afb7
humanhash:	hotel-spaghetti-july-failed
File name:	kvariant.ppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	79'304 bytes
First seen:	2025-11-03 21:54:00 UTC
Last seen:	2025-11-04 22:11:04 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:lWYmMxlj8c0UI5MP4fyZQZ2SuWt0eTpgQky54UiBQC6CK6dS9G0pjC:lWR6louwGCky54UiCLn1xC
TLSH	T15C731A42B31C0947D1A35EB03A3B17E1D7AFAE8121E4E748350FBB49D1B1E36954AEC9
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.29524.LC.UNOFFICIAL

Unix.Exploit.Mirai-9798002-0

Unix.Trojan.Mirai-9940367-0

Unix.Dropper.Mirai-9977145-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

DNS request

Connection attempt

Substitutes an application name

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/690924a0393eed3f38e29449/reports/50b7a696-d33a-4cb7-a458-ace4c2045050/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-11-03T19:21:00Z UTC

Last seen:

2025-11-04T01:50:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/6ee29731be3f52a6c4128b16f775a2bb0c605c48189cca5b73027df120c25f01/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/11948a61-16f1-4f7b-85be-bb27c6cf40d5

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f1151996-b390-4d28-b38a-f136b110be9d

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1807299

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6ee29731be3f52a6c4128b16f775a2bb0c605c48189cca5b73027df120c25f01

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/6ee29731be3f52a6c4128b16f775a2bb0c605c48189cca5b73027df120c25f01/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-11-03 21:54:45 UTC

File Type:

ELF32 Big (Exe)

AV detection:

23 of 37 (62.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n3rjomn6h5jknrasrmlpo5ncxmggaxcidcomuw3taj67cigcl4aq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251103-1sj6bazrdx/

Verdict:

Malicious

Tags:

Unix.Exploit.Mirai-9798002-0

YARA:

n/a

Link:

https://app.threat.zone/submission/95dd5f1a-28b4-4401-829f-086cf16162ee

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.