MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 11 File information Comments

SHA256 hash:	97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd
SHA3-384 hash:	da2c3f888b79164fd2ff811a9ca8b8f5c187e11ae6fa88c68f73a15977a39006e8645a99a8a1e1cd8f8d47497a04a87b
SHA1 hash:	52a9625c4114d5fff4292da167bc0b8d2d8576cb
MD5 hash:	369a6aea18f0df864cbfd92eb15600ff
humanhash:	lactose-jupiter-artist-skylark
File name:	arm7
Download:	download sample
Signature	Mirai Create hunting rule
File size:	183'040 bytes
First seen:	2026-09-22 23:34:42 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:2/Tvrwwx+tuzjVfgo0KU2BaSwnYJ7hIZld5UWwET0X3auQ:2Lvluu3Vfg9KU2BaSAYgLuET0XK
TLSH	T18C044C51FF968D13C1EA1779B99B47883332CB24E3EB3707D81866383E86B5D4E6A501
telfhash	t15c211e8c593d0a096a633574dc9c27b0e50a8862ad764f21cf28c790156e06a920ee7f
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

YARA.SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Runs as daemon

Receives data from a server

Kills processes

Creating a file

Sends data to a server

Substitutes an application name

Performs a bruteforce attack in the network

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expand gcc lolbin pup rust

Link:

https://www.filescan.io/uploads/6ab310b6da287c176b8b4be3/reports/4d822524-302c-48b5-bdde-7699a9cd4330/overview

Verdict:

Unknown

File Type:

elf.32.le

Link:

https://opentip.kaspersky.com/97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/173493ac-7528-480a-bea6-a82c81b80dcf

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b542711a-619c-4c2f-a1a3-15f07dfe6b03

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-09-22 23:35:24 UTC

File Type:

ELF32 Little (Exe)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s77exm46gqqg6fcl2qpizyhdotynd6bvt7ii4jzbg7agewv6i7oq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery

Link:

https://tria.ge/reports/260922-3k4abshh88/

Behaviour

Reads runtime system information

Changes its process name

Reads system network configuration

Creates a large amount of network flows

Enumerates active TCP sockets

Enumerates running processes

Contacts a large (1843) amount of remote hosts

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CoinMiner_Strings Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects mining pool protocol string in Executable
Reference:	https://minergate.com/faq/what-pool-address

Rule name:	CoinMiner_Strings_RID2DDE Create hunting rule
Author:	Florian Roth
Description:	Detects mining pool protocol string in Executable
Reference:	https://minergate.com/faq/what-pool-address

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	ELF_IoT_Persistence_Hunt Create hunting rule
Author:	4r4
Description:	Hunts for ELF files with persistence and download capabilities

Rule name:	ELF_Mirai Create hunting rule
Author:	NDA0E
Description:	Detects multiple Mirai variants

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	PUA_Crypto_Mining_CommandLine_Indicators_Oct21 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects command line parameters often used by crypto mining software
Reference:	https://www.poolwatch.io/coin/monero

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 97fe4bb39e34206f144bd41e8ce0e374f0d1f8359fd08e272137c0625abe47dd

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3889945/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample