MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10
SHA3-384 hash: cce7b621e32dcc0fca763e2ac05550077e8605d2d21e3af7bc56f9145f4620ce2a95e4cb6b0b79fa9948b52113089745
SHA1 hash: 55cc86f5b9a6801b439eb585214dda169c0353a6
MD5 hash: 4ac6cac9597d0d8a433c372e6ed68936
humanhash: march-stairway-ack-seventeen
File name:i686.ghost
Download: download sample
Signature Mirai
Create hunting rule
File size:123'664 bytes
First seen:2026-07-09 15:01:43 UTC
Last seen:2026-07-10 12:57:14 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 3072:0lmQ0+5qQxQbaGwY9ohHsTZ/LJ5G7h4YjUz:0lmQ0+5UrQhK/zGb
TLSH T1CBC35B86E792D0F3E1D302335193C7664731DA31414ACE0BF7083A75AD66A898D6BBBD
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30395.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29052.TSource.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sends data to a server
Connection attempt
Receives data from a server
Launching a process
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-07-09T13:25:00Z UTC
Last seen:
2026-07-11T10:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/660ec49c-ffbc-40b1-b0bf-e66aa6a1708c
Behavior Graph:
Download SVG
%3 guuid=40e342de-1900-0000-d212-817d47140000 pid=5191 /usr/bin/sudo guuid=3d14e7df-1900-0000-d212-817d4a140000 pid=5194 /tmp/sample.bin net send-data guuid=40e342de-1900-0000-d212-817d47140000 pid=5191->guuid=3d14e7df-1900-0000-d212-817d4a140000 pid=5194 execve a003fbbd-4bbf-5f54-b278-6aeca5c7df7d 94.154.43.158:2323 guuid=3d14e7df-1900-0000-d212-817d4a140000 pid=5194->a003fbbd-4bbf-5f54-b278-6aeca5c7df7d send: 139B guuid=796e06e1-1900-0000-d212-817d4d140000 pid=5197 /usr/bin/dash guuid=3d14e7df-1900-0000-d212-817d4a140000 pid=5194->guuid=796e06e1-1900-0000-d212-817d4d140000 pid=5197 execve guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201 /usr/bin/dash guuid=3d14e7df-1900-0000-d212-817d4a140000 pid=5194->guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201 execve guuid=ba6146e1-1900-0000-d212-817d4f140000 pid=5199 /usr/bin/uname guuid=796e06e1-1900-0000-d212-817d4d140000 pid=5197->guuid=ba6146e1-1900-0000-d212-817d4f140000 pid=5199 execve guuid=471af5e1-1900-0000-d212-817d52140000 pid=5202 /usr/bin/cat guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201->guuid=471af5e1-1900-0000-d212-817d52140000 pid=5202 execve guuid=9947fce1-1900-0000-d212-817d53140000 pid=5203 /usr/bin/grep guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201->guuid=9947fce1-1900-0000-d212-817d53140000 pid=5203 execve guuid=40e603e2-1900-0000-d212-817d54140000 pid=5204 /usr/bin/cut guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201->guuid=40e603e2-1900-0000-d212-817d54140000 pid=5204 execve guuid=2c0e0ae2-1900-0000-d212-817d55140000 pid=5205 /usr/bin/tr guuid=ec60afe1-1900-0000-d212-817d51140000 pid=5201->guuid=2c0e0ae2-1900-0000-d212-817d55140000 pid=5205 execve
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06a56a11-e589-4fc3-8780-55264bc61575
Score:
31%
Verdict:
Susipicious
File Type:
ELF
Link:
https://malprob.io/report/806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-07-09 15:02:47 UTC
File Type:
ELF32 Little (SO)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qbthhgi27cr44w5vgx53xoojhbpc7agurxntyt6dwnu5psi6ziia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
linux
Link:
https://tria.ge/reports/260709-sebb9adv2w/
Behaviour
Unexpected DNS network traffic destination
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_dayzddos
Create hunting rule
Author:NDA0E
Description:dayzddos botnet
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 806673991af8a3ce5bb535fbbbb9c9385e2f80d48ddb3c4fc3b369d7c91eca10

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3877974/
  
Delivery method
Distributed via web download

Comments