MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55
SHA3-384 hash:	1abf50ffcc16b5c7b4bb2452febe7d57c0eaf37d363bdda1208abd9389d961aea633fb113f364f565d66b24a1a6aa217
SHA1 hash:	cd268a941c7bb21ddd7448e2bfa8b1ba54174ca3
MD5 hash:	74bc7df7987f0547aaaab04c2f103675
humanhash:	pennsylvania-echo-single-undress
File name:	nabx86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	37'504 bytes
First seen:	2025-12-05 18:13:25 UTC
Last seen:	2025-12-06 04:39:54 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:nri1+Mmq/zSqk6aLOMrbZ6T2uB3jclX0ljJykcypodN:nu3mq/zSqALOikiAjclX0lNncypY
TLSH	T1DCF23949D953D8F5EC141EB13863A7729F74E97A04B8FA83DB55E931B803241620B7BC
telfhash	t18021e1e06db145fcf3d0be0eab6e2717273594530a9059fe44f26ec137f21a29070828
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

32

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-7755770-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885259-0

Alert

Create hunting rule

Unix.Trojan.Gafgyt-6735924-0

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69332160bba50eaf0423665f/reports/26d67ca8-c9e6-4213-b2d8-0ef3fea28143/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-12-05T16:25:00Z UTC

Last seen:

2025-12-06T02:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6c093a46-2cfb-400b-bf15-01b920f22bcd

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cdda6b71-a706-4bd0-9647-0b1cd33f6fdc

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1827528

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-05 18:16:38 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wzgwfm3tzksjsxv3uc33cz35mat622squ2w5xzttzukcczgctzkq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux

Link:

https://tria.ge/reports/251205-wws56swpgy/

Behaviour

Reads runtime system information

Changes its process name

Reads system network configuration

Creates a large amount of network flows

Enumerates active TCP sockets

Enumerates running processes

Renames itself

Contacts a large (6631) amount of remote hosts

Threat.Zone Malicious

Verdict:

Malicious

Tags:

trojan mirai Unix.Trojan.Mirai-7755770-0

YARA:

Linux_Trojan_Mirai_88de437f Linux_Trojan_Mirai_cc93863b Linux_Trojan_Mirai_8aa7b5d3

Link:

https://app.threat.zone/submission/046849bc-9040-46af-b09d-677519fea57a

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55