MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aaf1eb9116a3cc7fe8471d2a875e655fb763c10a61a65f9b8ad0a4278589959. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments

SHA256 hash: 8aaf1eb9116a3cc7fe8471d2a875e655fb763c10a61a65f9b8ad0a4278589959
SHA3-384 hash: c4793377fdec557dc7cc1109f854b81de35c20798e84fbb7b33d6c9444df68522c50d974033fcf0d44945b332bc7bc26
SHA1 hash: 2636a218029c370f5dd073996c33f0995208d88e
MD5 hash: eb3bd94f68da8381ed1b2ccd7842c09d
humanhash: alanine-quiet-maine-rugby
File name:arm6
Download: download sample
File size:33'039 bytes
First seen:2026-02-11 12:54:26 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:+/nvpten4U9vWYIxZM3Z0reIhsn35w0RZunVe10fT:+/nvpte4UtWYI0qreIhsnJxHRkT
TLSH T120E2C4897886C46249E813FEF47D10DF335977A9D0CE7162D9820F12768BA1F48B7B92
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf

Intelligence


File Origin
# of uploads :
1
# of downloads :
38
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai rust
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=67cfa3ff-1700-0000-43ad-4373d70b0000 pid=3031 /usr/bin/sudo guuid=ccb0fb01-1800-0000-43ad-4373e00b0000 pid=3040 /tmp/sample.bin guuid=67cfa3ff-1700-0000-43ad-4373d70b0000 pid=3031->guuid=ccb0fb01-1800-0000-43ad-4373e00b0000 pid=3040 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1867395 Sample: arm6.elf Startdate: 11/02/2026 Architecture: LINUX Score: 48 14 169.254.169.254, 80 USDOSUS Reserved 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 3 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 python3.8 dpkg 2->6         started        8 dash rm 2->8         started        10 dash rm 2->10         started        12 arm6.elf 2->12         started        signatures3 process4
Gathering data
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf 8aaf1eb9116a3cc7fe8471d2a875e655fb763c10a61a65f9b8ad0a4278589959

(this sample)

  
Delivery method
Distributed via web download

Comments