MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac3a7d1e56c6d4bc7df6d5b57cb2ac1c0e57e55cabb0f0e51879f9257f4e0f26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: ac3a7d1e56c6d4bc7df6d5b57cb2ac1c0e57e55cabb0f0e51879f9257f4e0f26
SHA3-384 hash: 09d0f1aa5a20359aef38db028009d9a0c75154a8ba0ecb2414b87f54874e512a179991966d18227e7baed7279804b6b6
SHA1 hash: e120032639b5c88d8195885ffc1903c2640c00f2
MD5 hash: bf8bd02ae24ac14bfd9d0bd098ff40a6
humanhash: august-muppet-video-orange
File name:arm7
Download: download sample
Signature Mirai
File size:65'672 bytes
First seen:2026-03-08 08:17:36 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:nMn6m9d5lXsxHpddcyR4GeVBpeEK9lS7tkJTSFq34bTh:Q9dIRpVxelpK2I4bTh
TLSH T17253E745BC428B1455EA36FEFF5E029A335717A8E3FA7202DA114F2167CEA4B0F72611
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
125
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand lolbin mirai rust
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Behavior Graph:
%3 guuid=05eb7c58-1700-0000-e534-1662aa0e0000 pid=3754 /usr/bin/sudo guuid=8fafb95a-1700-0000-e534-1662b10e0000 pid=3761 /tmp/sample.bin guuid=05eb7c58-1700-0000-e534-1662aa0e0000 pid=3754->guuid=8fafb95a-1700-0000-e534-1662b10e0000 pid=3761 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1880176 Sample: arm7.elf Startdate: 08/03/2026 Architecture: LINUX Score: 48 14 169.254.169.254, 80 USDOSUS Reserved 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 4 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 python3.8 dpkg 2->6         started        8 dash rm 2->8         started        10 dash rm 2->10         started        12 arm7.elf 2->12         started        signatures3 process4
Threat name:
Linux.Backdoor.Mirai
Status:
Malicious
First seen:
2026-03-08 08:18:18 UTC
File Type:
ELF32 Little (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ac3a7d1e56c6d4bc7df6d5b57cb2ac1c0e57e55cabb0f0e51879f9257f4e0f26

(this sample)

  
Delivery method
Distributed via web download

Comments