MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4
SHA3-384 hash:	8f103d95a708b82b02348e001b9da6e0ccb4da181570df711b5a3d853908f6e52c2ca00c587cd4e9c360448f3cecc6f4
SHA1 hash:	fec51cbc625fc727b79a39e8d5854bffafd9cc99
MD5 hash:	548130fffb462075da54f3a55a6b0fe7
humanhash:	edward-idaho-nine-carbon
File name:	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
Download:	download sample
Signature	Mirai Create hunting rule
File size:	76'272 bytes
First seen:	2026-08-20 02:55:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:WHiD82bcJMcC3juaGVEaycX/EmkJd7YRPv81c1Oi+Zr7dTZb6VJu8:WHiD8rJMczaGVmcXRv31Oi+Zr736VQ8
TLSH	T1697301AA184315EED4F5667423CE876ABF168952F513FC0E58C0BE478952036E903EA7
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	whack_sh
Tags:	elf exe UPX whack.sh

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	76'272 bytes
File size (de-compressed) :	238'604 bytes
Format:	linux/mips
Unpacked file:	c95b218ae1bb90daabbda622e7ad0b0da093e81f8ef1f59ff7065e3214bfa5e2

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b25eeae5-a8f1-497e-861a-55a695d61b65/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sets a file as executable

Runs as daemon

Locks files

Kills processes

Creating a file

Launching a process

Kills critical processes

Substitutes an application name

Deleting of the original file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

botnet mirai packed rootkit upx

Link:

https://www.filescan.io/uploads/6a866ce2e701fabf83e09e42/reports/276c67f2-b0f1-47ef-ad1b-28b3c7c32d80/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a30506af-b3f8-4814-a660-fcb1a3297622

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5f5ef7bb-70df-408a-8831-51fcf2ef908a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qdgryw5tmgsupwtr2gdih7wzhhl3yzgnejswo6j2vacraumq5w2a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery upx

Link:

https://tria.ge/reports/260820-dfapsadp9z/

Behaviour

Reads runtime system information

Changes its process name

Checks CPU configuration

Reads system network configuration

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

Deletes Audit logs

Deletes itself

Deletes system logs

Modifies the /etc/hosts DNS resolution file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/