MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4
SHA3-384 hash: 0c19ece4e41d4f65ce90b65b85bba58013b64c6fe008cec8f0301b6ee3ce12322a166185e554f93d75bb8316ea731a58
SHA1 hash: 297bd251f4d58be9921744e67d0b0d74c110c779
MD5 hash: 0aeaf7ae7b80b96718a7dc6c39e0ab2f
humanhash: nuts-virginia-magazine-louisiana
File name:shadow.arm7
Download: download sample
Signature Mirai
Create hunting rule
File size:98'360 bytes
First seen:2025-12-30 16:59:26 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:hVnvIgQzjN9454d407n0/dBecULypZ92oy7DhI+QldR/9mloyD/ig0PFmIW:NQ35nWdBpULy/SDhI+Qld0d0N3
TLSH T112A3D759E9829602D4D816FBBA5E119D330327A8F3EE3202CD305B25778AB1F0F77A51
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Link:
https://research.acce.ciphertechsolutions.com/results/c9722401-693b-4c22-b7bc-70d761d1a160/
Detection(s):
Sanesecurity.Malware.29052.TSource.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-1
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade mirai obfuscated rust
Link:
https://www.filescan.io/uploads/6954052d8d1aa9829e275b10/reports/c8ab73b3-d97c-438c-8953-adb0c7c7bbf3/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/feeac147-b2da-4d7d-904f-724710da96b9
Behavior Graph:
Download SVG
%3 guuid=0192ac57-1900-0000-2068-1f1b58140000 pid=5208 /usr/bin/sudo guuid=1d91155a-1900-0000-2068-1f1b59140000 pid=5209 /tmp/sample.bin guuid=0192ac57-1900-0000-2068-1f1b58140000 pid=5208->guuid=1d91155a-1900-0000-2068-1f1b59140000 pid=5209 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b6ddc11-ad5f-4afa-86e7-07a7309006ca
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1842176
Signature
Multi AV Scanner detection for submitted file
Sample deletes itself
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1842176 Sample: shadow.arm7.elf Startdate: 30/12/2025 Architecture: LINUX Score: 52 22 Multi AV Scanner detection for submitted file 2->22 9 shadow.arm7.elf 2->9         started        process3 signatures4 24 Sample deletes itself 9->24 12 shadow.arm7.elf 9->12         started        process5 process6 14 shadow.arm7.elf 12->14         started        process7 16 shadow.arm7.elf 14->16         started        18 shadow.arm7.elf 14->18         started        process8 20 shadow.arm7.elf 16->20         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-30 17:00:33 UTC
File Type:
ELF32 Little (Exe)
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vv2benoa4bwbftss7hxy4amqmuxliaglxmyx3wmqmcfobncp5d2a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery upx
Link:
https://tria.ge/reports/251230-vhsrtaxrdt/
Behaviour
Reads runtime system information
Changes its process name
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
Deletes itself
Modifies Watchdog functionality
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-1
YARA:
n/a
Link:
https://app.threat.zone/submission/fe4c51b9-a1ab-4c5e-a631-eee09550ba01
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Generic_Threat_8299c877
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ad741235c0e06c12ce52f9ef8e0190652eb400cbbb317dd990608ae0b44fe8f4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3742277/
  
Delivery method
Distributed via web download

Comments