MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406
SHA3-384 hash: 59f6c0f20e77e107b52695063387b0e174063d44f82d7962a57337e98c0f1231cf34faecef9b93cb3a48882f1468c4a8
SHA1 hash: a050def41175cdd73430325dcca4e1c2a75a4c6f
MD5 hash: e85130773196f3802bfa2c20e94527ee
humanhash: connecticut-jig-india-high
File name:mips
Download: download sample
Signature Mirai
Create hunting rule
File size:34'720 bytes
First seen:2025-08-18 16:51:44 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:8hwVwVBAVCztJohyuBZ6th/si5obDu5N1Z:dGIVStmyYZg0i1Z
TLSH T17BF252453A229FEDF728873947B78B30A74973D227E19684E25CD9041FB034D685FBA8
telfhash t12bf01c2c143852f0d3c58d9e6bedef38a4a184e799761e378950d66aa631a424c00d2c
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Opens a port
Sends data to a server
Receives data from a server
Connection attempt
DNS request
Runs as daemon
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68a35a59f516093e09c622b9/reports/3304677e-0391-40e2-9d83-09ce5462259a/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d647d555-c2b6-46b7-bb35-24bcf01b2eaf
Behavior Graph:
Download SVG
%3 guuid=83d573a9-1900-0000-e34f-b8f35b0d0000 pid=3419 /usr/bin/sudo guuid=02ac15ab-1900-0000-e34f-b8f3620d0000 pid=3426 /tmp/sample.bin guuid=83d573a9-1900-0000-e34f-b8f35b0d0000 pid=3419->guuid=02ac15ab-1900-0000-e34f-b8f3620d0000 pid=3426 execve guuid=e0b82aac-1900-0000-e34f-b8f3680d0000 pid=3432 /usr/bin/dash guuid=02ac15ab-1900-0000-e34f-b8f3620d0000 pid=3426->guuid=e0b82aac-1900-0000-e34f-b8f3680d0000 pid=3432 clone guuid=ea524dac-1900-0000-e34f-b8f3690d0000 pid=3433 /usr/bin/dash guuid=02ac15ab-1900-0000-e34f-b8f3620d0000 pid=3426->guuid=ea524dac-1900-0000-e34f-b8f3690d0000 pid=3433 clone
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/306231a8-ba3a-4565-9ee9-310467365b72
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1759515
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1759515 Sample: mips.elf Startdate: 18/08/2025 Architecture: LINUX Score: 48 18 169.254.169.254, 80 USDOSUS Reserved 2->18 20 conn.magicpacketlease.org 45.125.66.90, 23120, 38510, 38512 TELE-ASTeleAsiaLimitedHK Hong Kong 2->20 22 daisy.ubuntu.com 2->22 24 Multi AV Scanner detection for submitted file 2->24 8 mips.elf 2->8         started        10 python3.8 dpkg 2->10         started        signatures3 process4 process5 12 mips.elf 8->12         started        process6 14 mips.elf 12->14         started        16 mips.elf 12->16         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-08-18 16:52:38 UTC
File Type:
ELF32 Big (Exe)
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2vhownligcgr7t5o643ntsfdit62d6m2vqcj62er2jnjmksgqda._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250818-vdn8tsap7s/
Behaviour
System Network Configuration Discovery
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9dcb0cdf-c6e5-46fe-a94d-6ffc2f980bc3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf aeaa7759ab418468fe7d77b9b6ce451a27ed0fccd56024fb448e92d4b1523406

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3306236/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments