MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8
SHA3-384 hash:	8950f9c0f33abeeef5ed2928b499f9659aa05d73dc2a4577da5d8cec419de802a222026fabc536b5cc09adaf87ab9ed6
SHA1 hash:	fbdb27d58e9f5b4804d139fc7d6cdad493bbbf19
MD5 hash:	6ced6c7915412358bf6c582a7ade4c10
humanhash:	idaho-gee-diet-monkey
File name:	ppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	87'992 bytes
First seen:	2025-10-29 14:26:46 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:6hHbXJP+afPCBT9Hr2IIgLrQBgYziLGCnHugP1O7qj4+6aWSOsrJuHV:61V+akTDIvgxVOqc+9DIV
TLSH	T1AF834B02B31C0A47C0A35DB03A3F1BD087BFA6D111E4F689691EAB969675D332586FCD
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 dcd7d4b917223e33897da06b7fdb676d16aa4d7afc0276bb4525c275b0a45b10

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	40'268 bytes
File size (de-compressed) :	87'992 bytes
Format:	linux/ppc32
Packed file:	dcd7d4b917223e33897da06b7fdb676d16aa4d7afc0276bb4525c275b0a45b10

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Runs as daemon

Traces processes

Substitutes an application name

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin obfuscated remote threat

Link:

https://www.filescan.io/uploads/6902257d74c0dff58994a215/reports/4d6f0f52-b67a-4591-b9b5-f50fc3c7c504/overview

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2025-09-29T23:58:00Z UTC

Last seen:

2025-10-30T01:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3cf6b03f-b912-43b6-ad18-6dce227fabef

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/6a61c193-46b1-48b1-942c-895dcdb09a26

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1803940

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-29 14:44:36 UTC

File Type:

ELF32 Big (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u7h3ykpy6bpmvyoivg26prcbauukoyet7ggue6laypz2rcrdpc4a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251029-rvmjsazqct/

Verdict:

Malicious

Tags:

trojan gafgyt Unix.Dropper.Mirai-7135957-0

YARA:

Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024

Link:

https://app.threat.zone/submission/84e55936-3164-44de-8ca3-4c023c80b32f

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a7cfbc29f8f05ecae1c8a9b5e7c4410528a76093f98d427960c3f3a88a2378b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.