MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888
SHA3-384 hash:	d49675a16b808472a2abd505fbce280daa7594c59e284c5f931f571d5e0fdf50e601207897cb8da8dba50324983e49db
SHA1 hash:	0b88829f51dae22669733aec3024cc6ad671c54c
MD5 hash:	65b80c74ce3c8a64d325d81157788cd0
humanhash:	blue-potato-charlie-saturn
File name:	mini.arm5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	41'916 bytes
First seen:	2026-08-18 12:44:35 UTC
Last seen:	2026-08-19 05:28:44 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:62PKLw+W+c/Cgx+qU29C2fDbbsOcNpmNTREt566yeCj1sv91e:62yL1KbMqUn2f4OMCREa6zCj1S9
TLSH	T15A132A98F580CA26C6E4217AFA5E214D73531F78E2DA3202DE05AB3527FF5590F3B942
telfhash	t194d02b7b56a54ec83ac293c8018e241c4ced7b60ab10387ac21c6f4ee3c2891f10dc32
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Sends data to a server

Receives data from a server

Runs as daemon

Connection attempt

Substitutes an application name

Deleting of the original file

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

gcc masquerade rust

Link:

https://www.filescan.io/uploads/6a84541369fa77d82e2e5017/reports/837d97c9-edef-4ca1-9e9b-02112384f945/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

type:Mirai 31.77.227.102:9506

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a9bc850d-5b45-4c80-8363-caace0ec3f67

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ee15a219-0a83-42ba-9b18-c36685f33541

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2026-08-18 12:48:34 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v43m5m5dwfnliljgpgb6at2oukpngq7aluehvzd7slb2jxzvfcea._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260818-pzdfkahd35/

Behaviour

Writes file to tmp directory

Changes its process name

Deletes itself

Modifies Watchdog functionality

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/af36ceb3a3b15ab42d267983e04f4ea29ed343e05d087ae47f92c3a4df352888

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/