MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd
SHA3-384 hash: 117ca18e25b6a5a4dc173d663b01b2bce78e6c448a1d81c4a568f81f46b5b65e7f5ae6258452736ece4df558e4e06646
SHA1 hash: b00c5e06a9baabbe72951381c6dad72c9e687b5a
MD5 hash: fe0fd452310f96b7d4201af93bf255bb
humanhash: aspen-missouri-pizza-johnny
File name:pppc
Download: download sample
Signature Mirai
Create hunting rule
File size:75'612 bytes
First seen:2026-01-09 02:36:26 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:E/qLWBmfNfwlRdCGIcQOD8D1fITMDBkv1tF64Zzep:EmW8KufIoDeWp
TLSH T123733C41731C0A47D3675DB02A3F27D1D3BEE59025F4EA49751EAB8A9271E332086ECE
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 7394995b87abad7730182684b93fdd94d54db43b517d2debcbc8920ba9d78171
File size (compressed) :34'532 bytes
File size (de-compressed) :75'612 bytes
Format:linux/ppc32
Packed file: 7394995b87abad7730182684b93fdd94d54db43b517d2debcbc8920ba9d78171

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Link:
https://research.acce.ciphertechsolutions.com/results/52cd3ba9-3294-42b2-bd1a-52dbb7a47d94/
Detection(s):
Unix.Dropper.Mirai-7135957-0
Create hunting rule

Unix.Trojan.Mirai-9801524-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
Kills processes
Receives data from a server
Opens a port
Sends data to a server
DNS request
Connection attempt
Kills critical processes
Substitutes an application name
Deleting of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/696069b830368802bb7cdec9/reports/f56ad1ae-cc67-4990-84b6-ed26fc2d2b70/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2026-01-09T00:52:00Z UTC
Last seen:
2026-01-09T01:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0b31b865-ba6d-4632-8ad0-8cf340cb0fc8
Behavior Graph:
Download SVG
%3 guuid=91a524e1-1900-0000-aaa4-1ab186090000 pid=2438 /usr/bin/sudo guuid=886c96e4-1900-0000-aaa4-1ab18c090000 pid=2444 /tmp/sample.bin guuid=91a524e1-1900-0000-aaa4-1ab186090000 pid=2438->guuid=886c96e4-1900-0000-aaa4-1ab18c090000 pid=2444 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/166c5334-f28c-42bd-8795-3a332158f02f
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1847055
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample deletes itself
Sample tries to kill multiple processes (SIGKILL)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1847055 Sample: pppc.elf Startdate: 09/01/2026 Architecture: LINUX Score: 72 24 158.94.208.27, 18129, 49210, 49212 JANETJiscServicesLimitedGB United Kingdom 2->24 26 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->26 28 158.94.208.27 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 8 pppc.elf 2->8         started        11 systemd rsyslogd 2->11         started        13 xfce4-panel wrapper-2.0 2->13         started        15 28 other processes 2->15 signatures3 process4 signatures5 38 Sample deletes itself 8->38 17 pppc.elf 8->17         started        process6 process7 19 pppc.elf 17->19         started        22 pppc.elf 17->22         started        signatures8 36 Sample tries to kill multiple processes (SIGKILL) 19->36
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-09 02:36:41 UTC
File Type:
ELF32 Big (Exe)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2o6y2m3chqaqkkx7xwcxhwvqe3nkpr5r6ls2zn4soahhyxfbw6q._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:mirai linux
Link:
https://tria.ge/reports/260109-c3x8xsbs5f/
Malware Config
C2 Extraction:
158.94.208.27
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135957-0
YARA:
n/a
Link:
https://app.threat.zone/submission/84e7daeb-0ed1-4998-84be-9074193a31be
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 7394995b87abad7730182684b93fdd94d54db43b517d2debcbc8920ba9d78171

Mirai

elf 769dec699b11e0082957fdec2b9ed58136d53e3d8f972d65bc938073e2e50dbd

(this sample)

  
Dropped by
SHA256 7394995b87abad7730182684b93fdd94d54db43b517d2debcbc8920ba9d78171
  
URLhaus
https://urlhaus.abuse.ch/url/3742451/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 2aea921e2f7db40c2d958185d5684365

Comments