MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 994da7aae723ce6f30247b4004f28e23a5307ab7869b84d49c593c0a5447c2bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	994da7aae723ce6f30247b4004f28e23a5307ab7869b84d49c593c0a5447c2bf
SHA3-384 hash:	6e72f1edc891f6719ebe7c266f3c99843ffa5beb87fb326721c6f6aa35f9a973be72a159445eadd4f765c56689caec82
SHA1 hash:	8ee6eeb9a730a386975f540d6e2f0fe4503ba57b
MD5 hash:	ce749658898d73e02c78b9489a81d2c1
humanhash:	romeo-lactose-beryllium-nitrogen
File name:	sh4
Download:	download sample
Signature	Mirai Create hunting rule
File size:	62'804 bytes
First seen:	2025-02-27 23:46:46 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:/pWJDv7Z/+pCxKqCWz7lKAgBCi+GLtdFZQm:/ATtpYqdQAgBFxTZQm
TLSH	T190538D73CC266D6CC99886B07470CEB51763E590915B1EFE299AC63A9043ECDF6063F8
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Dropper.Mirai-7136288-0

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c0f9a02dfba428b46ef8b4linux22vpnfull_triage

Tags:

n/a

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/67c0f97ef8726576332b93b8/reports/2b58e546-5220-46a4-b220-c047a3e35b12/overview

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2c188833-900e-406c-bac9-08cde2c96a6b

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1626149

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/994da7aae723ce6f30247b4004f28e23a5307ab7869b84d49c593c0a5447c2bf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/994da7aae723ce6f30247b4004f28e23a5307ab7869b84d49c593c0a5447c2bf/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2025-02-28 03:52:11 UTC

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tfg2pkxhephg6mbepnaaj4uoeosta6vxq2nyjve4le6auvchyk7q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250227-3sxgratvcv/

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7136288-0

YARA:

n/a

Link:

https://app.threat.zone/submission/dbd808db-cedd-4b9d-aa89-649a714923da

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/994da7aae723ce6f30247b4004f28e23a5307ab7869b84d49c593c0a5447c2bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.