MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8
SHA3-384 hash: 0a67d1ecf3f502738d5b9edb7f71b85865eb423f29bcf4cc6e590e1083148ce73f8d7c9d0ba8b9dee30efceaa9cdcfe0
SHA1 hash: f4305507b797f178020aa0b99df12f623c23c7af
MD5 hash: 5b3b828aef5461f655d624a97a964ad0
humanhash: single-mike-eighteen-enemy
File name:m68k
Download: download sample
Signature Mirai
Create hunting rule
File size:74'432 bytes
First seen:2025-12-24 23:11:56 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:iJhZoAUvZWlQKp1mwjNsy0ynxJXjFaQSr8zty+aDy/gCDLcA/YlQwgdePNxIh:wA5h4HvFj3PPXjFaQSQy+aDLQcsYC8Oh
TLSH T18C7329D6F400DDBEF80EE73B84570506B231E7A60B920B762317796BBC750A5193BE86
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Trojan.Gafgyt-7782058-0
Create hunting rule

Unix.Trojan.Mirai-9940650-0
Create hunting rule

Unix.Trojan.Mirai-10018298-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/694c735ce126b9ff43907708/reports/a54a5b19-2ad0-4306-bc55-2852a334d8ed/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-12-24T00:48:00Z UTC
Last seen:
2025-12-26T15:50:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/86ea3d7f-0574-42aa-8479-30158eaafb74
Behavior Graph:
Download SVG
%3 guuid=0c669d36-1800-0000-a57e-436ef30b0000 pid=3059 /usr/bin/sudo guuid=ff245c38-1800-0000-a57e-436ef90b0000 pid=3065 /tmp/sample.bin guuid=0c669d36-1800-0000-a57e-436ef30b0000 pid=3059->guuid=ff245c38-1800-0000-a57e-436ef90b0000 pid=3065 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d3f7d3ae-4e6a-438c-88ca-00dff7b24588
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1839091
Signature
Connects to many ports of the same IP (likely port scanning)
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1839091 Sample: m68k.elf Startdate: 25/12/2025 Architecture: LINUX Score: 64 125 102.39.126.149, 30476, 34738 Vox-TelecomZA South Africa 2->125 127 88.24.16.172, 21648 TELEFONICA_DE_ESPANAES Spain 2->127 129 24 other IPs or domains 2->129 137 Multi AV Scanner detection for submitted file 2->137 139 Connects to many ports of the same IP (likely port scanning) 2->139 13 systemd gdm3 2->13         started        15 systemd gpu-manager 2->15         started        17 systemd accounts-daemon 2->17         started        20 24 other processes 2->20 signatures3 process4 file5 23 gdm3 gdm-session-worker 13->23         started        25 gdm3 gdm-session-worker 13->25         started        35 3 other processes 13->35 27 gpu-manager sh 15->27         started        29 gpu-manager sh 15->29         started        31 gpu-manager sh 15->31         started        37 5 other processes 15->37 131 Reads system files that contain records of logged in users 17->131 33 accounts-daemon language-validate 17->33         started        123 /var/log/wtmp, data 20->123 dropped 133 Sample tries to kill multiple processes (SIGKILL) 20->133 135 Sample reads /proc/mounts (often used for finding a writable filesystem) 20->135 39 6 other processes 20->39 signatures6 process7 process8 41 gdm-session-worker gdm-x-session 23->41         started        43 gdm-session-worker gdm-wayland-session 25->43         started        45 sh grep 27->45         started        47 sh grep 29->47         started        49 sh grep 31->49         started        51 language-validate language-options 33->51         started        53 sh grep 37->53         started        55 sh grep 37->55         started        57 3 other processes 37->57 process9 59 gdm-x-session dbus-run-session 41->59         started        61 gdm-x-session Xorg Xorg.wrap Xorg 41->61         started        63 gdm-x-session Default 41->63         started        65 gdm-wayland-session dbus-run-session 43->65         started        67 language-options sh 51->67         started        process10 69 dbus-run-session dbus-daemon 59->69         started        72 dbus-run-session gnome-session gnome-session-binary 1 59->72         started        74 Xorg sh 61->74         started        76 dbus-run-session dbus-daemon 65->76         started        78 dbus-run-session gnome-session gnome-session-binary 1 65->78         started        80 sh locale 67->80         started        82 sh grep 67->82         started        signatures11 141 Sample tries to kill multiple processes (SIGKILL) 69->141 143 Sample reads /proc/mounts (often used for finding a writable filesystem) 69->143 84 dbus-daemon 69->84         started        94 7 other processes 69->94 86 gnome-session-binary gnome-session-check-accelerated 72->86         started        96 2 other processes 72->96 88 sh xkbcomp 74->88         started        90 dbus-daemon 76->90         started        92 dbus-daemon 76->92         started        98 5 other processes 76->98 100 2 other processes 78->100 process12 process13 102 dbus-daemon at-spi-bus-launcher 84->102         started        104 gnome-session-check-accelerated gnome-session-check-accelerated-gl-helper 86->104         started        106 gnome-session-check-accelerated gnome-session-check-accelerated-gles-helper 86->106         started        108 dbus-daemon false 90->108         started        110 dbus-daemon false 92->110         started        116 7 other processes 94->116 112 dbus-daemon false 98->112         started        114 dbus-daemon false 98->114         started        118 3 other processes 98->118 process14 120 at-spi-bus-launcher dbus-daemon 102->120         started        signatures15 145 Sample reads /proc/mounts (often used for finding a writable filesystem) 120->145
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-24 05:33:13 UTC
File Type:
ELF32 Big (Exe)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbawmd4sveoxrftdz4vyjlfxarocp7bcq4udwdotxs2m5ihlxhma._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251224-266f5sas7c/
Verdict:
Malicious
Tags:
Unix.Trojan.Gafgyt-7782058-0
YARA:
n/a
Link:
https://app.threat.zone/submission/73be40aa-f056-4305-a6f7-b418e65e0383
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3742840/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3742967/

Comments