MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0e47c2c38969352a17996e19239fa93bdd9f63e2aa39d33cb6289e4595c2f5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	a0e47c2c38969352a17996e19239fa93bdd9f63e2aa39d33cb6289e4595c2f5f
SHA3-384 hash:	6757fabf516c5203317021582a86ff78066de81d03c068c34560f35797b3ce09b965c16fc86ec10cd3e6e088210aaf09
SHA1 hash:	76cc148004b2e3c5a2ff499a1e31b7c3217892ea
MD5 hash:	5f901e0bd45e7bf9e9940c5024e8722f
humanhash:	lithium-july-minnesota-pluto
File name:	xnxnxnxnxnxnxnxni386xnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	115'356 bytes
First seen:	2025-12-24 15:33:29 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:l8WlFnRC8FzEoj1ds6vdCA0sQe4NiBa7+P9kRCAzUg4GMAIE4r931SBxJgC2Y7RU:aWrRCji1Cr1sIexAUPAIE4rZ1SSCLK
TLSH	T15BB35B42E6A3E0F0E28701701157F3EA8935EA305556CEDAEFA93D70EC71A825D9B71C
telfhash	t19a4114f52dba0eec77d08844e28a5fa26e19e77f2470617704a2257037fbd514176c38
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 c6775a0ae4534b64fa829f89e3e913fe34cc851db71997dd12d3af51d1a73a57

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	60'756 bytes
File size (de-compressed) :	115'356 bytes
Format:	linux/i386
Packed file:	c6775a0ae4534b64fa829f89e3e913fe34cc851db71997dd12d3af51d1a73a57

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

rust

Link:

https://www.filescan.io/uploads/694c0803e126b9ff439011a8/reports/82c25943-0f68-4b86-9baf-0cc1210eaa20/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-12-24T13:55:00Z UTC

Last seen:

2025-12-24T16:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a0e47c2c38969352a17996e19239fa93bdd9f63e2aa39d33cb6289e4595c2f5f/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/5e9f27f4-0e9b-45bd-ba40-2b97aeae5e60

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/072bdf4e-803a-4203-9c29-413605d82dc7

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1838914

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a0e47c2c38969352a17996e19239fa93bdd9f63e2aa39d33cb6289e4595c2f5f

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/a0e47c2c38969352a17996e19239fa93bdd9f63e2aa39d33cb6289e4595c2f5f/

Threat name:

Linux.Trojan.Gafgyt

Status:

Suspicious

First seen:

2025-12-24 15:34:36 UTC

File Type:

ELF32 Little (Exe)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=udshylbys2jvfilzs3qzeop2so65t5r6fkrz2m6lmke6iwk4f5pq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/251224-szj5wsfz8g/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

Deletes Audit logs

Deletes journal logs

Deletes system logs

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5e7c4079-e42f-464f-96d5-7a3bab7abdab

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.