MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fd0af3856042b1c518f1461d8f78fb5fbce20f17fba6382faf30d11619af57f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments

SHA256 hash: 7fd0af3856042b1c518f1461d8f78fb5fbce20f17fba6382faf30d11619af57f
SHA3-384 hash: 0e90fe904a482e0adcc44e5fa11f1bd7b7fdf3e7d7bbc62d77cde5ca22b0419a79f6b823ff5da6e5227ef7bd5ec38205
SHA1 hash: 729f4f4dde8cb6f0388b422bf7d1015ba22d9ff8
MD5 hash: cd767f7da1a229b9e9aa1e191f9f27c9
humanhash: high-sad-saturn-indigo
File name:dlr.spc
Download: download sample
Signature Mirai
File size:1'280 bytes
First seen:2026-02-01 07:29:38 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 24:3XNlDPqS9NRTS+5hcNMGQ+vhCn1dPNfLJ9lm3GVNTxQs:jNfTSUUMGR63NN9wWVNSs
TLSH T1E921F0FAFBBB4A57C85484360EA713653730D84C0121D22A7A216A0D9C526616F461F0
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
66
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=03de56f8-1a00-0000-dd1b-8af52c0b0000 pid=2860 /usr/bin/sudo guuid=c800a2fa-1a00-0000-dd1b-8af5330b0000 pid=2867 /tmp/sample.bin guuid=03de56f8-1a00-0000-dd1b-8af52c0b0000 pid=2860->guuid=c800a2fa-1a00-0000-dd1b-8af5330b0000 pid=2867 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1861123 Sample: dlr.spc.elf Startdate: 01/02/2026 Architecture: LINUX Score: 48 14 169.254.169.254, 80 USDOSUS Reserved 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 3 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 python3.8 dpkg 2->6         started        8 dash rm 2->8         started        10 dash cut 2->10         started        12 9 other processes 2->12 signatures3 process4
Threat name:
Linux.Worm.Mirai
Status:
Malicious
First seen:
2026-02-01 07:18:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 7fd0af3856042b1c518f1461d8f78fb5fbce20f17fba6382faf30d11619af57f

(this sample)

  
Delivery method
Distributed via web download

Comments