MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a
SHA3-384 hash:	1bce43be031e32aed6b17b7ecd0903380547d555cdd7ec9742536766ca4e6910083923dc2e27599eeefcdcfd33dced4a
SHA1 hash:	966b19ab47559f10c357f69c599ae6bc44ebc4f4
MD5 hash:	add75034afa4d18731f1e98b1b92e61c
humanhash:	winner-mango-zebra-nuts
File name:	wewe5.johnsmith
Download:	download sample
Signature	Mirai Create hunting rule
File size:	47'380 bytes
First seen:	2025-11-13 01:06:29 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:pDs0TdG6bQrHn+P36JJozA3nmQMwx//TEw62nu/PSyev1/e6gKI:a0T3bmG3KSzsowZbEY2PShvY6gK
TLSH	T1B9231A85B9819A17CAC0167BFF0F43897B2A6398E2ED3303DD266F50378B92B0D67111
telfhash	t159e07221408c8c6a8f94942ca10f27209026b8024e7a0c0406feddcc1ba28c3cf3202f
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 bce34aed842502447e7e303932a358422bee070d4be7b8e5044339e743719242

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	24'208 bytes
File size (de-compressed) :	47'380 bytes
Format:	linux/arm
Packed file:	bce34aed842502447e7e303932a358422bee070d4be7b8e5044339e743719242

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai rust

Link:

https://www.filescan.io/uploads/69152f4afb02f8945a80947d/reports/0fd541d4-2dc1-402e-bbd4-bb5164919ecb/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

166

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-12T22:53:00Z UTC

Last seen:

2025-11-12T23:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dfaa2209-9b55-42b2-afd4-439af950f0bf

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1813065

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-11-13 01:07:26 UTC

File Type:

ELF32 Little (Exe)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v3ixsqv7y2ce7uia5jrla2imb2lv7yppntochk6jwzqm56rceofa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/251113-hd8w1shq8x/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6055b0bd-713a-4159-b993-c2ad4a717568

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/aed17942bfc6844fd100ea62b0690c0e975fe1ef6cdc23abc9b660cefa22238a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.