MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10
SHA3-384 hash:	60b62876b7f74cd5b823a80f58b271887d8bc45cd6c6c3e2fad1e76b4b02e5061e5f459f28295f8312b59662f718bee6
SHA1 hash:	754e87bda60c519aef70675224b48b846b892edf
MD5 hash:	4e24204e7b5dc8623a078e30669fdead
humanhash:	beer-video-may-carolina
File name:	sora.x86
Download:	download sample
Signature	Mirai Create hunting rule
File size:	28'048 bytes
First seen:	2025-10-14 20:14:53 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHkINuoM:qMwxdyoEUnDz+Y8tqHWXmEdK0Nv
TLSH	T147C2E17FB6A96A67FA6C233DE431811B03A5F41C97AE279763400433E69E42D7532CD8
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai-63.UNOFFICIAL

Unix.Trojan.Mirai-9955978-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

masquerade packed threat upx

Link:

https://www.filescan.io/uploads/68eeaff071883144ef3725e0/reports/772ce55a-a9f0-416b-9163-ae49690fb3da/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-10-14T17:40:00Z UTC

Last seen:

2025-10-14T19:32:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f5ccd329-b865-4de5-98f3-21ebd45839b1

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9c96cf61-ce46-4a10-ace4-9abbe9f1da1f

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1795222

Signature

Malicious sample detected (through community Yara rule)

Sample is packed with UPX

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-14 20:17:39 UTC

File Type:

ELF32 Little (Exe)

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sie5u2zctpbeevwpe2btoi74hj6isjzkll3vjbq4bfotkc4z3yia._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:sora botnet linux upx

Link:

https://tria.ge/reports/251014-y2yzqabs2f/

Behaviour

Mirai

Mirai family

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-9955978-0

YARA:

n/a

Link:

https://app.threat.zone/submission/c3f6c59d-dac8-46ea-abf7-df43f4b54a82

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.50

Link:

https://yomi.yoroi.company/submissions/9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.