MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d62a94ba04ccb38cfd0dd66d7600bfab5545839cdc534c005f761a91e3007c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments

SHA256 hash: 8d62a94ba04ccb38cfd0dd66d7600bfab5545839cdc534c005f761a91e3007c1
SHA3-384 hash: 24424b51acb5edf7ebd53d47d1511ed33b64242c6cdafc4db1e08ab951b299e6e3174e2c81ee37b3d2c90925db125640
SHA1 hash: 3c3635dbb434ac01a9eac8304911aa0ca1e6a68d
MD5 hash: 1e0cd85f6ba5153256a7575dfdce7711
humanhash: batman-twelve-london-spring
File name:mips
Download: download sample
Signature Mirai
File size:214'188 bytes
First seen:2025-11-20 21:42:26 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:IehdaANNe86gWItpr9er9bpxa2eSdWkUuayjUyQNZ:hlNNe86gWItd9erUpSdrUijUXZ
TLSH T1D524961E6F228F7DF7A8873057B79E21975C23D636E1D641E1ACC6101E6028E641FFA8
telfhash t15f414f580e7813f4a3399c9d059dff7ad6a330da7f166c378e11e46aa769a839d10c0c
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 2daf43fb7e635c338f3c37f0109a8cac0d1c15e26c288889512d095f40e556dd
File size (compressed) :61'880 bytes
File size (de-compressed) :214'188 bytes
Format:linux/mips
Packed file: 2daf43fb7e635c338f3c37f0109a8cac0d1c15e26c288889512d095f40e556dd

Intelligence


File Origin
# of uploads :
1
# of downloads :
73
Origin country :
NL NL
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
mirai
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-11-20T18:51:00Z UTC
Last seen:
2025-11-20T19:23:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.b
Status:
terminated
Behavior Graph:
%3 guuid=22309807-1800-0000-4383-d795160c0000 pid=3094 /usr/bin/sudo guuid=2fd48e09-1800-0000-4383-d7951e0c0000 pid=3102 /tmp/sample.bin guuid=22309807-1800-0000-4383-d795160c0000 pid=3094->guuid=2fd48e09-1800-0000-4383-d7951e0c0000 pid=3102 execve
Gathering data
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1818186 Sample: mips.elf Startdate: 20/11/2025 Architecture: LINUX Score: 48 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 mips.elf 2->10         started        signatures3 process4
Threat name:
Linux.Backdoor.Mirai
Status:
Malicious
First seen:
2025-11-20 21:43:18 UTC
File Type:
ELF32 Big (Exe)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:mirai discovery
Behaviour
System Network Configuration Discovery
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-8041698-0
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 8d62a94ba04ccb38cfd0dd66d7600bfab5545839cdc534c005f761a91e3007c1

(this sample)

  
Delivery method
Distributed via web download

Comments