MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96
SHA3-384 hash:	50dcf3be474a1328efe8f4c460ac929bccc150b3311634da641786dbb62666f39691468e2c7c5c4264066cdd0d1280a4
SHA1 hash:	c4e270ed5c70de5b8200d7451147ec23738c77f7
MD5 hash:	8298614d94b5598d8b2122b591523336
humanhash:	steak-dakota-july-kansas
File name:	wewe5.johnsmith
Download:	download sample
Signature	Mirai Create hunting rule
File size:	47'380 bytes
First seen:	2025-11-16 06:44:22 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:pGNi8eWvZosIIS6h+scSeNtzCp2+QMyPnoHhSlwyafqa1sXjKI:18eWvZpIITcR/z4Fy/oomyaSaqjK
TLSH	T12F231A85B981AA13CAD01677FF0E439D7B26679CE2ED3303D926AF50378B92B0D67111
telfhash	t1aae0cd261589587997c40026559e3361da1364144e771c501dcffd0d1377a74e53603d
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 4deb6cc31464d5a0276e42b7963991d57c8a8b680264ac0f8e12cd1d13fa1924

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	24'216 bytes
File size (de-compressed) :	47'380 bytes
Format:	linux/arm
Packed file:	4deb6cc31464d5a0276e42b7963991d57c8a8b680264ac0f8e12cd1d13fa1924

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai rust

Link:

https://www.filescan.io/uploads/6919730ba4cfab8e885c7472/reports/1b840c9c-36ba-433b-ab47-ad9f7fd46845/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

166

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-16T04:07:00Z UTC

Last seen:

2025-11-16T04:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2fb4fc8d-0424-4cf0-86c0-f5e1f3f4c4e7

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1814842

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-11-16 06:45:37 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r3npu2ub7o6nmmg6p3xzx72fogjavazezsdha2az56jmv3ycxkla._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/251116-hjce1axrhv/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/55068fed-dba6-4040-a5d0-529680dac16e

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8edafa6a81fbbcd630de7eef9bff4571920a8324cc86706819ef92caef02ba96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.