MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09
SHA3-384 hash: 756ddd251e44a0ad8d95883aa1315288b4a763b7a6ed712157fab883935089e0104efc2170b9ef19ff2b0052c249278f
SHA1 hash: 71ad3dff4d2da95fcb71740a121f1ae93a70bde6
MD5 hash: 55ee45bb1e4789419f9c7803a2d718f7
humanhash: purple-ceiling-sodium-oregon
File name:wewe8.johnsmith
Download: download sample
Signature Mirai
Create hunting rule
File size:24'360 bytes
First seen:2025-11-17 22:58:55 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:u/kti5OnQVZGgnXdgSzYMs3GWxZWh+cqnGdnqT8oXMJXX7+M4uVcqgw05VxJi:oYiQQhraGcZWwcqnGdnm8ocJH794uVcy
TLSH T1E0B2DF65E5005FEAE89FAEF0A8B0D399FF901F4A3B8548C52189DF73125B115AA88DC0
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :24'360 bytes
File size (de-compressed) :47'336 bytes
Format:linux/ppc32
Unpacked file: 125e0b5ae5193b4c50d797e7e079833e78ca680f66dcc2484b8de8fd66ab792f

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-9936831-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Runs as daemon
Creating a file in the %temp% directory
Receives data from a server
Kills processes
Locks files
Opens a port
Deleting a recently created file
Sends data to a server
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed upx
Link:
https://www.filescan.io/uploads/691ba8c8a4e47f6c207211f6/reports/b722c5f1-4f76-4d8e-9514-f76ebc76debe/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-11-17T22:01:00Z UTC
Last seen:
2025-11-18T06:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/95abec68-dc82-4f66-b77b-c8332bf85468
Behavior Graph:
Download SVG
%3 guuid=bc0a96b6-1a00-0000-f10d-704738090000 pid=2360 /usr/bin/sudo guuid=c2d11eb8-1a00-0000-f10d-70473d090000 pid=2365 /tmp/sample.bin guuid=bc0a96b6-1a00-0000-f10d-704738090000 pid=2360->guuid=c2d11eb8-1a00-0000-f10d-70473d090000 pid=2365 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5d40868d-c5d1-4f97-87d2-ca39496fbc26
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1815655
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1815655 Sample: wewe8.johnsmith.elf Startdate: 18/11/2025 Architecture: LINUX Score: 60 17 192.159.99.47, 3512, 49986, 49988 CYBERLYNKUS United Kingdom 2->17 19 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->19 21 3 other IPs or domains 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Sample is packed with UPX 2->27 7 wewe8.johnsmith.elf 2->7         started        9 dash rm 2->9         started        11 dash rm 2->11         started        13 python3.8 dpkg 2->13         started        signatures3 process4 process5 15 wewe8.johnsmith.elf 7->15         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-11-17 22:59:22 UTC
File Type:
ELF32 Big (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbqwkeo5wo2mh7p3wnskhunrg22tkezhhaf5phjtqr5twd7ixyeq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/251117-2yjx6sfr8w/
Verdict:
Malicious
Tags:
Unix.Trojan.Mirai-9936831-0
YARA:
n/a
Link:
https://app.threat.zone/submission/51415624-364f-431b-ae6e-7150a7925075
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09

(this sample)

Mirai

elf 125e0b5ae5193b4c50d797e7e079833e78ca680f66dcc2484b8de8fd66ab792f

  
URLhaus
https://urlhaus.abuse.ch/url/3703977/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 125e0b5ae5193b4c50d797e7e079833e78ca680f66dcc2484b8de8fd66ab792f
  
Dropping
MD5 7f11a3d17ae72ff470870013416484b3

Comments