MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f
SHA3-384 hash:	43770c8b0cd457b9c383603ccd3781ab1209f3fc8716aad50937dfdc285c5fcc0578c97185b1e6e05f98988a0558d139
SHA1 hash:	fb1ec2e96ee104c71e019ff61de2fc4090c527c1
MD5 hash:	7f0714fae91b7844312f47e16ab91ecc
humanhash:	thirteen-beryllium-nuts-london
File name:	dlr.arm6
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'464 bytes
First seen:	2026-02-01 07:29:39 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	24:ZouKGTA3wnHflfmN25xz1tVv3gRGI9i/Buk52nlxrR+bLNs:zKG83wnHtmN25xBPseBuk52nlxr+LN
TLSH	T1C031F19066D0ADB8CCE8907F9D56432073A4DF44E1CB3163A2086F18BD2EE7C2C2A849
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

41

Origin country :

DE

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Mirai-1.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/697f0127930564ff3c818233/reports/511094e4-0456-4ad6-a04f-cb352ba9e383/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-02-01T05:02:00Z UTC

Last seen:

2026-02-01T05:51:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/63a9524e-bf7e-44d7-850d-1095a89f3eef

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/42241c1d-87c1-4407-b2cd-d08c3941ae1c

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1861124

Signature

Antivirus detection for dropped file

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f/

ReversingLabs TitaniumCloud Linux.Downloader.Mirai

Threat name:

Linux.Downloader.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-01 07:18:38 UTC

File Type:

ELF32 Little (Exe)

AV detection:

20 of 38 (52.63%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xd7uel75rbg4z364tao5yfh7squ7wbfzczko6ysu55qbzelce5xq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260201-jb6jjsdv4f/

Behaviour

Writes file to tmp directory

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b8ff422ffd884dccefdc981ddc14ff9429fb04b91654ef6254ef601c9162276f