MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648
SHA3-384 hash: 98dafe8d4daeaf67ecfb5b040fa780c55addb4353ad29b8044155f4837a2827bac4d3a5610f9fc89a5dac17c1896bde7
SHA1 hash: 49062ef9c97794459fc7ddf1ba2ca96313112734
MD5 hash: 36477897fb99d9410f8b925173ac5906
humanhash: coffee-north-thirteen-football
File name:akido.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:29'960 bytes
First seen:2025-08-26 05:31:18 UTC
Last seen:2025-08-26 21:38:43 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:ItFPMu43+Knj412MjX2YNoTdv0Wt4B1lkracDJs3UozP:ID0uwqxkTN0l+racDUzP
TLSH T15CD2E1A91B448871DB948639AC7C834523475665E1FE33621A401B2AE2832DCDDBBEAD
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :29'960 bytes
File size (de-compressed) :70'524 bytes
Format:linux/arm
Unpacked file: 01401d5c3088a1325d988538ab7250a5159bcf0d7d5a6e93366dfe059976a273

Intelligence

File Origin
# of uploads :
3
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-9976978-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed threat upx
Link:
https://www.filescan.io/uploads/68ad4779fc438b9ff4b81cbe/reports/c84ae0e3-1fae-485a-9e7c-47df2b0ed931/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
51
Number of processes launched:
10
Processes remaning?
false
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648
Behaviour
Information Gathering
Botnet C2s
TCP botnet C2(s):
type:Mirai 36.50.54.209:9506
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.le
Link:
https://opentip.kaspersky.com/b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8f1f623a-1594-44dc-95b7-b5e794683b08
Behavior Graph:
Download SVG
%3 guuid=2acb2584-1b00-0000-4727-24d03b090000 pid=2363 /usr/bin/sudo guuid=ca09f786-1b00-0000-4727-24d03c090000 pid=2364 /tmp/sample.bin guuid=2acb2584-1b00-0000-4727-24d03b090000 pid=2363->guuid=ca09f786-1b00-0000-4727-24d03c090000 pid=2364 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/33acf963-60ce-4073-abce-5ed75faa29d3
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1765099
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1765099 Sample: akido.arm.elf Startdate: 26/08/2025 Architecture: LINUX Score: 76 22 161.252.167.223 ZNETAS-KW Kuwait 2->22 24 160.0.2.179, 23 WOODYNET-2US Mauritius 2->24 26 98 other IPs or domains 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 34 Sample is packed with UPX 2->34 8 akido.arm.elf 2->8         started        signatures3 process4 process5 10 akido.arm.elf 8->10         started        12 akido.arm.elf 8->12         started        14 akido.arm.elf 8->14         started        process6 16 akido.arm.elf 10->16         started        18 akido.arm.elf 10->18         started        20 akido.arm.elf 10->20         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-08-26 05:39:31 UTC
File Type:
ELF32 Little (Exe)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wahkpao2t2jgtdnvpxa53535juicr6bcsn5liylfxne2e2rkozea._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
upx
Link:
https://tria.ge/reports/250826-f9ksyswmv3/
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-9976978-0
YARA:
n/a
Link:
https://app.threat.zone/submission/6b684004-836e-4440-80d9-2e2b38f13d5e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 68f75588bb196e1c62cd7d8d05b3ed50e0c9e446b684e65ebd1511379a0573c8

Mirai

elf b00ea781da9e92698db57dc1ddf77d4d1028f822937ab46165bb49a26a2a7648

(this sample)

Mirai

elf 01401d5c3088a1325d988538ab7250a5159bcf0d7d5a6e93366dfe059976a273

  
URLhaus
https://urlhaus.abuse.ch/url/3611631/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 01401d5c3088a1325d988538ab7250a5159bcf0d7d5a6e93366dfe059976a273
  
Dropping
MD5 a0738579105da5c5ec8fc10b14e75f02
  
Dropped by
SHA256 68f75588bb196e1c62cd7d8d05b3ed50e0c9e446b684e65ebd1511379a0573c8
  
Dropped by
MD5 35cb4a27477cedd8d9368a617b6deabd
  
URLhaus
https://urlhaus.abuse.ch/url/3611630/
  
Dropped by
SHA256 d2cb9381ab6e1ec0796f6e6a9053c4aff0f55cbb4a791e9dc3167c381ad18e9d
  
Dropped by
MD5 95e141923ab2d26a36bcf2e96ce101ee
  
Dropped by
SHA256 1d5e2241b40519a63e251ab55f00125f07dc062ac26329f3c7e809a607074271
  
Dropped by
MD5 808a7e7878d72c60a356b5b2356cffc9
  
URLhaus
https://urlhaus.abuse.ch/url/3611637/
  
URLhaus
https://urlhaus.abuse.ch/url/3611660/

Comments