MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc
SHA3-384 hash:	9d2bd2981c775e00d2c2c7c6f1e097ff76e8716934e99503bdcc78620fe1bc2e5cbabdeb9d88f45a5462c9df70d8d632
SHA1 hash:	ab7b561c8d631555236279e11cd3f832d898b8df
MD5 hash:	e342faf268e2d699c86ddcbf4b39b3eb
humanhash:	autumn-edward-charlie-william
File name:	daredevil.mipsrouter
Download:	download sample
Signature	Mirai Create hunting rule
File size:	58'168 bytes
First seen:	2026-08-21 10:32:33 UTC
Last seen:	2026-08-22 04:33:37 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:oezmIhv2CueFdSSiRSBKXlEScOSa2x22W+ixjaVJu+:oeSFBadcSoXHcOS/22zitaVQ+
TLSH	T10443022D842901E8D9B1C5790E840372BB258A746E1FF84EF1CDE21F29945773843AFE
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	58'168 bytes
File size (de-compressed) :	190'124 bytes
Format:	linux/mips
Unpacked file:	efb8fbd919f6367e2d72fe9069cbbabb368fcf73b44b3db7cf281fc01acf023b

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f55e79a8-e5e7-4a0b-8d17-2c9d863dcc36/

Detection(s):

SecuriteInfo.com.Linux.Mirai.9816.6535.27902.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Kills processes

Connection attempt

Runs as daemon

Creating a file

Traces processes

Substitutes an application name

Deleting of the original file

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

mips

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc

Behaviour

Anti-VM

Anti-Debugging

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ea896e4c-8ec2-4613-bdfc-19c9783b58da

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/43bf7e3b-ee44-4606-a10f-0905298f2103

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-08-21 10:33:34 UTC

File Type:

ELF32 Big (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wvysfxxlbwneulmmx73iimbsksydtjw2xy7jxsy3a5zxqn3kopga._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm discovery upx

Link:

https://tria.ge/reports/260821-mlme7sah73/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Checks hardware identifiers (DMI)

Traces itself

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b57122deeb0d9a4a2d8cbff684303254b039a6dabe3e9bcb1b077378376a73cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_DVR_Botnet_Hama_UPX Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects packed and unpacked ELF IoT/DVR botnet variants targeting UPX compression structures and uncompressed code

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/