MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6
SHA3-384 hash:	bd707512d0af5093d3358d4949384ad7c796519dc7f13803461cbdddd4cb134aa05d4d2ffe9be54d0ba72a111a520b7a
SHA1 hash:	d3f6a97ebb98c10a637dec14610288c969734bf4
MD5 hash:	5fa6bb58f501e5f34d2b653cb941b2fb
humanhash:	floor-johnny-nineteen-river
File name:	skid.armv5l
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	108'508 bytes
First seen:	2025-04-21 10:38:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:uSnwXj+4Re4kzj/ceItPFmdAgUTfE9DO3IM2NQwL7qQ+vLIqLqGgzex/T3TEOCZ:yj+ZHKtPsWgUTMk32NQQwLqGzfCZ
TLSH	T144B30B4DE861AB2581E529BAFE5E44CD330217BCD2EB71158C065F60778F98D0E3EAC6
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.ELF.Mirai-CQU.25709.13587.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680621982203b3e10cd2313clinux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Runs as daemon

Creating a file

Opens a port

Receives data from a server

Sends data to a server

Substitutes an application name

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6806204790767142c3dda7ae/reports/dfba57d5-d749-445f-ab43-b0557ebb9b55/overview

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/475f0256-7efa-44c3-bfeb-b5689805bf5c

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1670254

Signature

Performs DNS TXT record lookups

Suricata IDS alerts for network traffic

Uses STUN server to do NAT traversial

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-21 10:39:08 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tb4ligb34bulmohaizlkalcwphycuwuyfzdszqoes7ggkq2f6o3a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access discovery

Link:

https://tria.ge/reports/250421-mpz6gatq13/

Behaviour

Reads runtime system information

Changes its process name

Reads process memory

Enumerates running processes

Renames itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6