MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2
SHA3-384 hash:	7dfb9d8e4080dc3cdc37f75bc8f7fd224fda7c4cc160b543bbf6a294d416ee025af3d776ca88f1b46d968a9c65e11f19
SHA1 hash:	2d05c2d38df76b1bf2727be1bdb2987ade66e181
MD5 hash:	ecf5c42e83916d21ea1babde89ba9ed4
humanhash:	blue-harry-music-neptune
File name:	armv4l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	73'312 bytes
First seen:	2025-03-30 11:33:38 UTC
Last seen:	2025-04-18 18:06:19 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:KVPTKtWP1IXaATJcZ6zsw8Gf3CgYBIQdg8:YnP18RSVsag
TLSH	T192633A957C829612C9D43276FA1E42CD372657E8E3EA3213DD221F6477CAC2B0E37652
telfhash	t19b21ddfa0d692dcf5bf05500928ef27e6dac35ba2f44354ae1aab90a51d32c1702dc02
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e92e25cfd0a37f830a24e3linux22vpnfull_triage

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 172.217.192.127:3478

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/40f9583c-7214-477c-8d9c-f477d8b7917f

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1652153

Signature

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Performs DNS TXT record lookups

Sample deletes itself

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-03-30 11:34:21 UTC

File Type:

ELF32 Little (Exe)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qxmdfn3p7j3chrorjqabbwzv7spkiovl2gexgftrybfml473ltza._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250330-npkw8axxft/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/85d832b76ffa7623c5d14c0010db35fc9ea43aabd189731671c04ac5f3fb5cf2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Generic_Threat_d94e1020 Create hunting rule
Author:	Elastic Security

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research