MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad
SHA3-384 hash:	aa9b4dcc08b5dabac8a8a0cf4b49aae9771d4fdd83c90c2c397f99e679350fe4542d29a91edbc3873635e7894da58192
SHA1 hash:	b9ee3ba08dccf8f7bb3b55b7837ce44b46db6da9
MD5 hash:	7b30af53e1a4f0cfb7616e657f8f8d25
humanhash:	asparagus-aspen-montana-twelve
File name:	wewe4.johnsmith
Download:	download sample
Signature	Mirai Create hunting rule
File size:	50'520 bytes
First seen:	2025-11-16 07:23:22 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:HPNi8FW0hoolQISbh+Hf9ONG8642G8Mui1oc+NZylryVVzuvfKI:c8FW0hnlQxgfIU8hBu6MzylmruvfK
TLSH	T18A330984B981AA17CAD14677FF0E438D7B266798E2DE3303C926AF51378B92B0D67111
telfhash	t1aae0cd261589587997c40026559e3361da1364144e771c501dcffd0d1377a74e53603d
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 f226837d4436f2332a4741d386b1b40d041a0e02ad3fcdf173a7e02b02fb609b

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	25'704 bytes
File size (de-compressed) :	50'520 bytes
Format:	linux/arm
Packed file:	f226837d4436f2332a4741d386b1b40d041a0e02ad3fcdf173a7e02b02fb609b

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai rust

Link:

https://www.filescan.io/uploads/69197c2153bda2a5d9f6900b/reports/3ad680d6-a156-47ef-b7e1-a6eb43d5852d/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

159

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-16T04:59:00Z UTC

Last seen:

2025-11-16T05:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8b54bab8-ff78-4b2a-befb-e7d54541aac1

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1814853

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-11-16 07:24:19 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qnk4kkfnj3gb7ik3u53q66dtel7eco4kjim6clrjmddsj6f4ugwq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/251116-h8hnbatpek/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8249d5ed-e9d8-42b6-a7d9-210ec87617e2

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8355c528ad4ecc1fa15ba7770f787322fe413b8a4a19e12e2960c724f8bca1ad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.