MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111
SHA3-384 hash: ef0ee407394aee9b5c9455889a409f1dc5c6f441fc370c3fc1d31e760a27f2d3479529f1cab416d1d5088cb37bbb47c2
SHA1 hash: b8c5b3380d4d7c4a4f0b84ec167c2942ec01aa57
MD5 hash: 35d6a8e81b956804dc6cb86e4f0b5fef
humanhash: fourteen-equal-one-seventeen
File name:moobs
Download: download sample
Signature Mirai
Create hunting rule
File size:81'092 bytes
First seen:2025-09-09 15:56:55 UTC
Last seen:2025-09-11 12:14:59 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:Iwgj3ANDgbTCJM8HgLlHqDV7SAns081UnqMzExPRA3+bg7dsA0i:FDgbgM8il4VyzA3+4CAf
TLSH T1BB83C80E6E218FBEF76CC73447B78E31979923D622D1C681D26CD2141E6434E642FBA8
telfhash t16f11915c497023d497360c952b2eff77d5a030de57225d378f12a4adaabdd825e00c0c
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ELF.Mirai-CYQ.93192955.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
base64
Link:
https://www.filescan.io/uploads/68c04e81a7b97e046b937783/reports/9e5c8f6f-e5bb-4394-a4d9-a57b2c78bdf7/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-09-09T17:49:00Z UTC
Last seen:
2025-09-09T17:49:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.iu
Link:
https://opentip.kaspersky.com/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/71c79783-8f48-4d30-ad85-cadf69d77c14
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1774141
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111/
Verdict:
Malicious
Threat:
Backdoor.Linux.Mirai
Link:
https://tip.neiki.dev/file/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-09-09 15:58:39 UTC
File Type:
ELF32 Big (Exe)
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oltfn7c7qd5vo37u474usd5beibzoisddmopzkxntoduq3bwgeiq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/250909-tebtfsxxgz/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d6c23183-5235-441f-b023-c0686270eeb0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh b8cb9d067db68522bab93f83dfe9b99532a013477fe15d768235404259e037a0

Mirai

elf 72e656fc5f80fb576ff4e7f9490fa122039722431b1cfcaaed9b87486c363111

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3620586/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3620524/
  
URLhaus
https://urlhaus.abuse.ch/url/3621068/
  
Dropped by
SHA256 b8cb9d067db68522bab93f83dfe9b99532a013477fe15d768235404259e037a0
  
Dropped by
MD5 3db15a3043cdc0b016c3acf0b88f0e3c
  
URLhaus
https://urlhaus.abuse.ch/url/3621069/
  
URLhaus
https://urlhaus.abuse.ch/url/3621066/
  
Dropped by
SHA256 264c263b24e8de2d15a286c79a4179ce6023da5febe0f2381a7289bb3668cd2c
  
Dropped by
MD5 57e1080e94f778670c368d635c2bb41c
  
URLhaus
https://urlhaus.abuse.ch/url/3621691/

Comments