MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab72fb0d08fa4c2354343f533de7a26edfdee7e983b121d25a212e013c8a2a4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: ab72fb0d08fa4c2354343f533de7a26edfdee7e983b121d25a212e013c8a2a4c
SHA3-384 hash: b163a0094089baba389141fd0732f6e248f48999421d8d626b90b5a73d72ae4f3bbd2eb8b4b83f60b18dda532872abb1
SHA1 hash: 7d2196ac30e977f5db00f3b6a591fd7190e5b91c
MD5 hash: 4d27e34019e9af41e93b957f17efe21f
humanhash: potato-bravo-solar-mars
File name:sparc
Download: download sample
Signature Mirai
File size:44'692 bytes
First seen:2025-06-18 10:33:29 UTC
Last seen:2025-06-19 02:16:22 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:f9ZEZ/LqwrQvl10XyO+75ostW9h3A1tqyIq:l2Z/LqwrQr0A75ozAtqyp
TLSH T12C135C31F6520827C8D6597D22E30235F2F58A4E2CB8A72A7E600F5DFF94A443553BE6
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
2
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
Status:
terminated
Behavior Graph:
%3 guuid=edd6d56c-1a00-0000-df76-fb66ae0a0000 pid=2734 /usr/bin/sudo guuid=195d7b6f-1a00-0000-df76-fb66b50a0000 pid=2741 /tmp/sample.bin guuid=edd6d56c-1a00-0000-df76-fb66ae0a0000 pid=2734->guuid=195d7b6f-1a00-0000-df76-fb66b50a0000 pid=2741 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1717337 Sample: sparc.elf Startdate: 18/06/2025 Architecture: LINUX Score: 48 18 109.202.202.202, 80 INIT7CH Switzerland 2->18 20 103.149.252.178, 37140, 5683 DVS-AS-VNVIETDIGITALTECHNOLOGYLIABILITYCOMPANYVN unknown 2->20 22 3 other IPs or domains 2->22 24 Multi AV Scanner detection for submitted file 2->24 8 sparc.elf 2->8         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 process5 14 sparc.elf 8->14         started        process6 16 sparc.elf 14->16         started       
Threat name:
Linux.Worm.Mirai
Status:
Malicious
First seen:
2025-06-18 10:35:41 UTC
File Type:
ELF32 Big (Exe)
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-9854559-0
YARA:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ab72fb0d08fa4c2354343f533de7a26edfdee7e983b121d25a212e013c8a2a4c

(this sample)

  
Delivery method
Distributed via web download

Comments