MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a22da1d4612d40341e19294ada8de0e399d56de4da6d2ae5bdb62d228072861b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments

SHA256 hash: a22da1d4612d40341e19294ada8de0e399d56de4da6d2ae5bdb62d228072861b
SHA3-384 hash: f6369dc2301ac2dcaa94e0c3c6636e58452ea543528e32fc7f9fbad2db9c709e54856c96b1261f4bf6b6b443f373af44
SHA1 hash: 1bc44d89dfb4cd3f1c26681019367b5cfb707236
MD5 hash: bceb73c370422a93b4a5ea086c4eb6e3
humanhash: seven-december-rugby-johnny
File name:SupplySrvsh4
Download: download sample
Signature Mirai
File size:26'432 bytes
First seen:2026-01-12 19:38:54 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:Matat810Ef2wtYOt4vqSYLDLDrk+zh4MeebSuD6ZuWbi0pb6N+DQ1rbC6L:MaFf2wtYwNSKvPnveeddMi0EN+D2rbCq
TLSH T1E9C27EBAD069E9D4C5610B38DC79C5B81F52B10183613DFA9FC449E7508BAB8FF0A365
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
204
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-01-12T17:48:00Z UTC
Last seen:
2026-01-14T00:38:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=e8fe4d8a-1500-0000-64ab-52bc050b0000 pid=2821 /usr/bin/sudo guuid=d41e498c-1500-0000-64ab-52bc080b0000 pid=2824 /tmp/sample.bin guuid=e8fe4d8a-1500-0000-64ab-52bc050b0000 pid=2821->guuid=d41e498c-1500-0000-64ab-52bc080b0000 pid=2824 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1849487 Sample: SupplySrvsh4.elf Startdate: 12/01/2026 Architecture: LINUX Score: 48 14 169.254.169.254, 80 USDOSUS Reserved 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 3 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 python3.8 dpkg 2->6         started        8 dash rm 2->8         started        10 dash rm 2->10         started        12 SupplySrvsh4.elf 2->12         started        signatures3 process4
Threat name:
Linux.Trojan.Multiverze
Status:
Malicious
First seen:
2026-01-12 19:39:27 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Result
Malware family:
Score:
  10/10
Tags:
family:mirai linux
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-7674518-0
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf a22da1d4612d40341e19294ada8de0e399d56de4da6d2ae5bdb62d228072861b

(this sample)

  
Delivery method
Distributed via web download

Comments