MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400
SHA3-384 hash: 430ee16e66d44df53cd73ec3c4b6714f87e38e39234d358794ca9ee35df7c60b6b24f409846b4978d60d55c2c4a9ad2b
SHA1 hash: ebdae1b6a28589ecc8d84557f0e83963396291cf
MD5 hash: aaed4dca8bd6bb42fc4efb358a02a554
humanhash: crazy-july-march-fourteen
File name:nexuscorp.x86
Download: download sample
Signature Mirai
Create hunting rule
File size:106'696 bytes
First seen:2026-01-10 11:12:41 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:9NbRhFmOJME21s1NRsMnGN50fsrEmtOltc6:9NNhGyf3K5vtOltc6
TLSH T12BA35B02B4D884FEC99AD2304F7FA516DA21F55D3234BA2F33947F252A1DE201F0E6A5
telfhash t12f41e1b02da9349471f7b39b730add99d8701d7108e070d5ee7369e5dd053580e964e2
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Dropper.Mirai-7540662-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
DNS request
Sets a written file as executable
Runs as daemon
Creating a file in the %temp% directory
Receives data from a server
Creating a file
Sends data to a server
Substitutes an application name
Deleting of the original file
Creates or modifies files in /init.d to set up autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6962345830368802bb7f2547/reports/48a14fab-69e8-428e-8206-bef9a1b885ec/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2026-01-10T08:21:00Z UTC
Last seen:
2026-01-11T00:27:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.b
Link:
https://opentip.kaspersky.com/89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6b9db229-1397-466b-913d-a2d495434afd
Behavior Graph:
Download SVG
%3 guuid=a1218a6b-1a00-0000-32d3-235bee080000 pid=2286 /usr/bin/sudo guuid=fd08ef6d-1a00-0000-32d3-235bf4080000 pid=2292 /tmp/sample.bin guuid=a1218a6b-1a00-0000-32d3-235bee080000 pid=2286->guuid=fd08ef6d-1a00-0000-32d3-235bf4080000 pid=2292 execve guuid=3624246e-1a00-0000-32d3-235bf6080000 pid=2294 /tmp/sample.bin guuid=fd08ef6d-1a00-0000-32d3-235bf4080000 pid=2292->guuid=3624246e-1a00-0000-32d3-235bf6080000 pid=2294 clone guuid=dc8d2f6e-1a00-0000-32d3-235bf7080000 pid=2295 /tmp/sample.bin zombie guuid=3624246e-1a00-0000-32d3-235bf6080000 pid=2294->guuid=dc8d2f6e-1a00-0000-32d3-235bf7080000 pid=2295 clone guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296 /tmp/sample.bin delete-file dns net send-data write-config write-file zombie guuid=dc8d2f6e-1a00-0000-32d3-235bf7080000 pid=2295->guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 36B 71c9b577-7409-5381-8789-9074b66f37ba r3brqw3d.b0ats.top:1010 guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296->71c9b577-7409-5381-8789-9074b66f37ba send: 11B guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515 /tmp/sample.bin net net-scan send-data guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296->guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515 clone guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516 /tmp/sample.bin net net-scan send-data guuid=c5453a6e-1a00-0000-32d3-235bf8080000 pid=2296->guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515|send-data send-data to 4097 IP addresses review logs to see them all guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515->guuid=61b78ef9-1a00-0000-32d3-235bd3090000 pid=2515|send-data send guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516|send-data send-data to 4096 IP addresses review logs to see them all guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516->guuid=70ef99f9-1a00-0000-32d3-235bd4090000 pid=2516|send-data send
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1ef1b40a-d06c-4b85-971b-a47e6d8bf6a7
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1847858
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample deletes itself
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1847858 Sample: nexuscorp.x86.elf Startdate: 10/01/2026 Architecture: LINUX Score: 80 34 44.137.155.1, 2323 ZUIJLEN-ASNL United States 2->34 36 46.50.255.198 ZSTTKASNovosibirskRussiaRU Russian Federation 2->36 38 100 other IPs or domains 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected Mirai 2->44 46 Uses known network protocols on non-standard ports 2->46 10 dash rm nexuscorp.x86.elf 2->10         started        12 dash rm 2->12         started        14 dash cat 2->14         started        16 8 other processes 2->16 signatures3 process4 process5 18 nexuscorp.x86.elf 10->18         started        process6 20 nexuscorp.x86.elf 18->20         started        process7 22 nexuscorp.x86.elf 20->22         started        file8 30 /usr/local/bin/sysd, ELF 22->30 dropped 32 /etc/rc.local, POSIX 22->32 dropped 48 Sample tries to set files in /etc globally writable 22->48 50 Sample deletes itself 22->50 52 Sample tries to persist itself using System V runlevels 22->52 26 nexuscorp.x86.elf 22->26         started        28 nexuscorp.x86.elf 22->28         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400/
Verdict:
Malicious
Threat:
Family.GAFGYT
Link:
https://tip.neiki.dev/file/89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400
Threat name:
Linux.Backdoor.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-01-10 11:13:29 UTC
File Type:
ELF64 Little (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhnocfwhpmadkj35hhp6aecdmjccpqiz3xxira5dxjkkiktk4qaa._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery linux persistence
Link:
https://tria.ge/reports/260110-nbg86sdv8f/
Behaviour
Writes file to tmp directory
Changes its process name
Modifies rc script
Write file to user bin folder
Deletes itself
Contacts a large (20853) amount of remote hosts
Creates a large amount of network flows
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Dropper.Mirai-7540662-0
YARA:
Linux_Trojan_Gafgyt_9e9530a7 Linux_Trojan_Gafgyt_807911a2 Linux_Trojan_Gafgyt_d4227dbf Linux_Trojan_Gafgyt_d996d335 Linux_Trojan_Gafgyt_d0c57a2e Linux_Trojan_Gafgyt_620087b9 Linux_Trojan_Gafgyt_0cd591cd Linux_Trojan_Gafgyt_33b4111a Linux_Trojan_Gafgyt_a33a8363
Link:
https://app.threat.zone/submission/232bd14b-ef7e-42fd-bbb0-f1c5610a6b34
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:Linux_Trojan_Gafgyt_0cd591cd
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_33b4111a
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_620087b9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_807911a2
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_9e9530a7
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_a33a8363
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d0c57a2e
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d4227dbf
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d996d335
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3755356/
  
Delivery method
Distributed via web download

Comments