MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7772f5a031cc2605d121d65d1097c6d8d2c374149892e94b8b145d817dc28e2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments

SHA256 hash: 7772f5a031cc2605d121d65d1097c6d8d2c374149892e94b8b145d817dc28e2e
SHA3-384 hash: df7302782ff1c468582df347bc3fa933dab007aebbf1ef71d1d851ffbb1fad3c5d0c4fa0c797aadd2f0a835705993605
SHA1 hash: 15303e5c2dba5e71b2fcc0a29330f252f383e25d
MD5 hash: 37c9c487d92f6b7882d047ece6d494a4
humanhash: missouri-twelve-tango-helium
File name:ppc
Download: download sample
Signature Mirai
File size:59'960 bytes
First seen:2025-02-26 21:08:39 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:q01NDkjhWBPe1ZuaDy0wYrudk/GrVd42+P:qEgoBd3YrucG7K
TLSH T175434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761182F9D
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
100
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Runs as daemon
Connection attempt
Receives data from a server
Opens a port
Sends data to a server
Substitutes an application name
Performs a bruteforce attack in the network
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1625239 Sample: ppc.elf Startdate: 26/02/2025 Architecture: LINUX Score: 56 18 193.168.151.181, 2323 ZOLBIZZBE Belgium 2->18 20 185.157.52.205 VOOSERVERSGB Italy 2->20 22 98 other IPs or domains 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 8 ppc.elf 2->8         started        signatures3 process4 process5 10 ppc.elf 8->10         started        12 ppc.elf 8->12         started        process6 14 ppc.elf 10->14         started        16 ppc.elf 10->16         started       
Threat name:
Linux.Trojan.Mirai
Status:
Malicious
First seen:
2025-02-26 21:09:18 UTC
File Type:
ELF32 Big (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:mirai botnet:kurc linux
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135870-0
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 7772f5a031cc2605d121d65d1097c6d8d2c374149892e94b8b145d817dc28e2e

(this sample)

  
Delivery method
Distributed via web download

Comments