MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b72abe2dfa3c4019baf0bace534a3fb3cb28484fa94ffe9b848ab162f1a44ef7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 7 File information Comments

SHA256 hash:	b72abe2dfa3c4019baf0bace534a3fb3cb28484fa94ffe9b848ab162f1a44ef7
SHA3-384 hash:	e43fdb52e07f013b16f27cd6475adaad336feebcfdc6d3202299ffe5ab5fb0c226867e62094c86228e0002e9b4abd441
SHA1 hash:	38054c838352f74adbf2d4074010463ac504bb10
MD5 hash:	2a537b3aa7898985925aca948edb097a
humanhash:	monkey-papa-island-delaware
File name:	rep.i486
Download:	download sample
Signature	Mirai Create hunting rule
File size:	92'364 bytes
First seen:	2025-04-17 00:08:12 UTC
Last seen:	2025-04-17 08:07:16 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:eOfMQr4osL1jMBkXIWSTYLpo7kKF34DNuU831kbv+yjfR5Tr:zYL1I0Byco7nlxuyGL
TLSH	T102930849ED93D3F2C902A075012BA33A5F3099A13ED0FE6BD39CFF656912949544E2AC
telfhash	t1ef31b4b95eb11cd9f7d05804e29e1731da7c637b2a643aa34af22c2133e96028177d39
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30645.LC.UNOFFICIAL

Sanesecurity.Malware.31069.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Unix.Trojan.Gafgyt-6981160-0

Unix.Dropper.Mirai-7135893-0

Unix.Dropper.Mirai-7135900-0

Unix.Dropper.Mirai-7135951-0

Unix.Dropper.Mirai-7136105-0

Unix.Trojan.Mirai-7755770-0

Unix.Trojan.Mirai-7759336-0

Unix.Trojan.Mirai-7772538-0

Unix.Trojan.Mirai-8041689-0

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Mirai-9924065-0

Unix.Trojan.Gafgyt-9940653-0

Unix.Trojan.Mirai-9943763-0

Unix.Trojan.Mirai-9944690-0

Unix.Trojan.Mirai-9945195-0

Unix.Trojan.Mirai-10004218-0

Unix.Trojan.Mirai-10008934-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680048432203b3e10ccfeb43linux22vpnfull_triage

Tags:

shellcode vmdetect

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Runs as daemon

Connection attempt

Receives data from a server

Opens a port

DNS request

Sends data to a server

Kills processes

Substitutes an application name

Performs a bruteforce attack in the network

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-vm lolbin masquerade remote

Link:

https://www.filescan.io/uploads/680046a390767142c3d81429/reports/8fcabce4-7e8f-433d-a62c-6a05b5e7b9d7/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

Full report:

https://elfdigest.com/brief/b72abe2dfa3c4019baf0bace534a3fb3cb28484fa94ffe9b848ab162f1a44ef7

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/052d8b68-da7b-4682-8d6a-a492ad3f135d

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1666867

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b72abe2dfa3c4019baf0bace534a3fb3cb28484fa94ffe9b848ab162f1a44ef7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b72abe2dfa3c4019baf0bace534a3fb3cb28484fa94ffe9b848ab162f1a44ef7/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2025-04-17 00:09:09 UTC

File Type:

ELF32 Little (Exe)

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w4vl4lp2hrabtoxqxlhfgsr7wpfsqscpvfh75g4erkywf4nej33q._file

Result

Malware family:

n/a

Score:

9/10

Tags:

discovery linux rootkit

Link:

https://tria.ge/reports/250417-afhhvaxves/

Behaviour

Loads a kernel module

Contacts a large (28568) amount of remote hosts

Creates a large amount of network flows

Verdict:

Malicious

Tags:

trojan mirai Unix.Trojan.Gafgyt-6981160-0

YARA:

Linux_Trojan_Mirai_3a56423b Linux_Trojan_Mirai_6e8e9257

Link:

https://app.threat.zone/submission/aa049a1c-8549-4c55-869d-ee2030e1b632

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.