MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b16deaf0823f10c89651ddbed29727c9e0f3dbd613ca81c452b9f0ecbebb8013. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	b16deaf0823f10c89651ddbed29727c9e0f3dbd613ca81c452b9f0ecbebb8013
SHA3-384 hash:	fd55820432ef63998a6659400883fbb994d06f75c730eee097a4e6e65d60706854d2cb168aab463cb28f8377b3bc2cdb
SHA1 hash:	819f1b725e0242fff51679aeea0f85df69fb2563
MD5 hash:	fe3179f7ca0fb4124aa09021b517feb1
humanhash:	oklahoma-avocado-mango-idaho
File name:	bot_x86-64
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'099'344 bytes
First seen:	2026-02-01 20:00:27 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	24576:xkX7SNLD+uvY9sPuqYc52Q2ItbjBYmXg:xkLSNLKuvYimqYc5bNbV
TLSH	T1A4357C5AF2B370BCD167C030439FDB63A835F47A01226DBB65C49A352D62EA01729F67
telfhash	t10eb17d7449ea34b0a3d7d9017322f4b5897118f662f836a11727be98edc0f801da646f
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Result

Gathering data

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2026-01-12T19:30:00Z UTC

Last seen:

2026-01-14T02:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b16deaf0823f10c89651ddbed29727c9e0f3dbd613ca81c452b9f0ecbebb8013/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/103a4f37-b5c9-4a3d-ad40-c91d62a3ed39

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/481dda50-9e9f-4dbc-b000-7c5d621b8887

Score:

96%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b16deaf0823f10c89651ddbed29727c9e0f3dbd613ca81c452b9f0ecbebb8013

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/b16deaf0823f10c89651ddbed29727c9e0f3dbd613ca81c452b9f0ecbebb8013/

Threat name:

Linux.Exploit.CVE-2021-36260

Status:

Malicious

First seen:

2026-01-13 01:43:01 UTC

File Type:

ELF64 Little (Exe)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wfw6v4ech4imrfsr3w7nffzhzhqphw6wcpfidrcsxhyozpv3qajq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260201-yrfemaey6b/

Behaviour

Reads runtime system information

Reads CPU attributes

Enumerates running processes

Modifies rc script

Modifies systemd

Modifies Watchdog functionality

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	ELF_Mirai Create hunting rule
Author:	NDA0E
Description:	Detects multiple Mirai variants

Rule name:	F01_s1ckrule Create hunting rule
Author:	s1ckb017

Rule name:	malwareelf55503 Create hunting rule

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	PUA_Crypto_Mining_CommandLine_Indicators_Oct21 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects command line parameters often used by crypto mining software
Reference:	https://www.poolwatch.io/coin/monero