MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824
SHA3-384 hash:	e319062d96d45a927524cf1539ea76ffbfa6bec97a383ad5dacf1e2f631f52d5cdcb5b18de0b303ee110ccbd42f91386
SHA1 hash:	4ba730a312665e2f21c5fff5d14c0157d00e3bf2
MD5 hash:	8832508a610e1be1939eeac36f4d652e
humanhash:	spring-high-illinois-butter
File name:	morte.arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	92'176 bytes
First seen:	2025-07-15 15:56:33 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:n/nWDc4DJszZ7HV5KZ7hqq7Kh5vLZaUs0SQV+UXiLyODFCu7IxBY1F81:ODc4D815Kmq+hVLZaUOyODFCumBT
TLSH	T17D932B5AFD818B21D9C502BAFA1E118E3313177CD2EE73129D186F20778B96B0E7B855
telfhash	t1aaf05091c66415fe3be0068fc1bf75378c6730e735012985d65d7a8d4625dd9712843b
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 55bd81bc000ebd24dc7571b745420bb1faf9607112da3723482fe5f045cd67de

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	43'884 bytes
File size (de-compressed) :	92'176 bytes
Format:	linux/arm
Packed file:	55bd81bc000ebd24dc7571b745420bb1faf9607112da3723482fe5f045cd67de

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin obfuscated remote

Link:

https://www.filescan.io/uploads/68767a7619132d9848807047/reports/2a86101a-ee47-4148-b27f-01e8a4af537f/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/921f655f-a076-40f2-b75a-47fa132d8c9d

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

Mirai, Xmrig

Detection:

malicious

Classification:

troj.mine

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1737253

Signature

Found strings related to Crypto-Mining

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-07-15 15:57:38 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u2wgs3d55ivwdaapibvynb6igdkt2p6s66wyxnt35lfpx2iynasa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/250715-td4g3sxshx/

Malware Config

C2 Extraction:

last.galaxias.cc

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d9133193-4721-431a-93f1-595cae7df277

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/a6ac696c7dea2b61800f406b8687c830d53d3fd2f7ad8bb67beacafbe9186824

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.