MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0536dc36f7b910ad30d51c15fe4f6b9c7a1e1a5536065a06bb2765aefb570ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	b0536dc36f7b910ad30d51c15fe4f6b9c7a1e1a5536065a06bb2765aefb570ed
SHA3-384 hash:	5e6e6cd1dd55842f037fa055262920b26fd300633e068d00d81f485cd77a0459c71abbca69683da5cb20d6a6774aefd3
SHA1 hash:	406098647db6c271d00cbac0faa5aa3d10379ed9
MD5 hash:	cfbac355b2b707ca94d153a1ed030b59
humanhash:	seven-robert-steak-delta
File name:	boatnet.ppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	53'116 bytes
First seen:	2026-02-16 01:05:00 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:CVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINn2I0jG4u+qgw09V:UaovZsIRfoPaaKYaY21G4u+qgwg
TLSH	T1D633F2B5961295C4FBB3F6624C8FEFB8B72115D1F35BC7814106AB40256B4B53218FC4
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	53'116 bytes
File size (de-compressed) :	158'744 bytes
Format:	linux/ppc32
Unpacked file:	48d3ee6d0156e1164b3527af4b07d9b74a0a47e6f0fef516ec2c0dbb85812ba2

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5136b4ed-29c1-4af0-a345-0e2324085c05/

Detection(s):

Unix.Trojan.Mirai-9936831-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sends data to a server

Receives data from a server

Runs as daemon

Gathering data

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e7134fbb-6a64-418e-b771-00ddf1df8305

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/39a3a552-13f2-4d20-b595-d3a734266567

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b0536dc36f7b910ad30d51c15fe4f6b9c7a1e1a5536065a06bb2765aefb570ed

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/b0536dc36f7b910ad30d51c15fe4f6b9c7a1e1a5536065a06bb2765aefb570ed/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-02-16 00:53:03 UTC

AV detection:

14 of 37 (37.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wbjw3q3ppoiqvuynkhav7zhwxhd2dynfknqglidlwj3fv35vodwq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

linux upx

Link:

https://tria.ge/reports/260216-bfrl7agy7c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b0536dc36f7b910ad30d51c15fe4f6b9c7a1e1a5536065a06bb2765aefb570ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research