MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338
SHA3-384 hash: b9d5cdb7b409b019508061c8bdbcd7aa7c306d8a647386e1200d703a83c32a6fd17094f6f738d04cf207ef0093007ffe
SHA1 hash: 8087a75c16763128c07ce5ae448c22b7044de5dc
MD5 hash: 7fc1e7b0605455e8edde7e3836bd8421
humanhash: iowa-diet-hamper-king
File name:nklspc
Download: download sample
Signature Mirai
Create hunting rule
File size:94'220 bytes
First seen:2026-01-18 13:46:21 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:2UouoVB7rfzYs1+cxaiWHICa2fNrlHMT1EpgSBzzA7uhdx:flKHcs1SfNuZgfzAw
TLSH T13B933B11ED395D2BC5C0313B51E34630F5B6579E16BC9A1B3EA32D9CEF14620312FAAA
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-7755770-0
Create hunting rule

Unix.Trojan.Mirai-9885259-0
Create hunting rule

Unix.Trojan.Mirai-10008934-0
Create hunting rule

Unix.Trojan.Gafgyt-6735924-0
Create hunting rule

Verdict:
Malicious
File Type:
elf.32.be
First seen:
2026-01-18T11:33:00Z UTC
Last seen:
2026-01-18T12:14:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.gen
Link:
https://opentip.kaspersky.com/b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/68a9e3d7-022a-4b51-98a7-d47f59a3a0cd
Behavior Graph:
Download SVG
%3 guuid=c7607fb0-1900-0000-8e85-c10430090000 pid=2352 /usr/bin/sudo guuid=e0e6aab2-1900-0000-8e85-c10436090000 pid=2358 /tmp/sample.bin guuid=c7607fb0-1900-0000-8e85-c10430090000 pid=2352->guuid=e0e6aab2-1900-0000-8e85-c10436090000 pid=2358 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f2d81414-32aa-4e4b-a262-6d99338b7f1e
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1852765
Signature
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1852765 Sample: nklspc.elf Startdate: 18/01/2026 Architecture: LINUX Score: 48 18 155.96.168.115 ZAMRENZM United States 2->18 20 140.169.214.224 WWUUS United States 2->20 22 100 other IPs or domains 2->22 24 Yara detected Mirai 2->24 8 nklspc.elf 2->8         started        10 dash rm 2->10         started        12 dash rm 2->12         started        signatures3 process4 process5 14 nklspc.elf 8->14         started        process6 16 nklspc.elf 14->16         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-18 13:47:52 UTC
File Type:
ELF32 Big (Exe)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbguexqktsjihhnpzbsml4i3qkbsqtvkqzb3kzzj4qx7tdmpkm4a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260118-q37z1sdy3c/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1db9efc7-f11d-4bab-8476-f42677e0af36
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b04d425e0a9c92839dafc864c5f11b8283284eaa8643b56729e42ff98d8f5338

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3740299/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3739207/

Comments