🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b
SHA3-384 hash: ac246f5fb179cb9cff8ee596ac83919a8c37c4dac138c3a11833ea75f37b225e9ce56cc3fb5f62c6c389853f02e0f293
SHA1 hash: 82d4b0024a41b0d53e06923bdabb61968fbbecc6
MD5 hash: 90568e189476bea0791f50e5386b2ed2
humanhash: network-snake-yellow-mississippi
File name:reaver.x86
Download: download sample
Signature Mirai
Create hunting rule
File size:160'788 bytes
First seen:2026-08-29 02:32:22 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:ppx/aI9rxUVCQ8MFT1jB5TFACZMsxs3FnMgregQgEoMP5gVjE:ppdtUVCWFTpTFACZMs6MpVYMP5l
TLSH T1D6F35B46E713D4F0D84615B001BB9B398E74EC735536DA16E7B87FB19D22A80A61B33C
telfhash t1de512a77aff50dec77c09911e38b2761dd08d13b255075ba46662ac422f2f126365c3e
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 a874fbca4692d90fd9864bb58df89282abf03e75ea9f87bbd44f5a6416c05faf
File size (compressed) :71'532 bytes
File size (de-compressed) :160'788 bytes
Format:linux/i386
Packed file: a874fbca4692d90fd9864bb58df89282abf03e75ea9f87bbd44f5a6416c05faf

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Mirai.10757.22192.96.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Kills processes
Deletes a file
Launching a process
Runs as daemon
Changes owner for a written file
Changes access rights for a written file
Opens a port
Receives data from a server
Changes the time when the file was created, accessed, or modified
Connection attempt
Gains root access
Creating a file
Creates or modifies symbolic links
Creating a process from a recently created file
Sets a written file as executable
Sends data to a server
Writes files to system subdirectory
Substitutes an application name
Writes files to system directory
Creates or modifies files in /cron to set up autorun
Creates or modifies symbolic links in /init.d to set up autorun
Creates or modifies files in /init.d to set up autorun
Creates or modifies files to set up autorun
Deleting of the original file
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
gcc masquerade obfuscated rust
Link:
https://www.filescan.io/uploads/6a9244ed3ab8f3ef81c7fc9c/reports/a9c0b54a-7ecd-48df-b42b-a8955387e493/overview
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-08-29T00:42:00Z UTC
Last seen:
2026-08-30T21:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cb836f8e-500b-49ab-b134-39e49af4c90b
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1965584
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates /etc/ld.so.preload
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Multi AV Scanner detection for submitted file
Protects files from modification
Sample deletes itself
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Writes identical ELF files to multiple locations
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1965584 Sample: reaver.x86.elf Startdate: 29/08/2026 Architecture: LINUX Score: 100 133 176.65.139.137, 45882, 45884, 45886 STORMINDUSTRIESHostingServicesUS Netherlands 2->133 135 217.60.195.187, 1900 NETPOOLIN Netherlands 2->135 145 Malicious sample detected (through community Yara rule) 2->145 147 Antivirus detection for dropped file 2->147 149 Antivirus / Scanner detection for submitted sample 2->149 151 2 other signatures 2->151 15 reaver.x86.elf 2->15         started        19 systemd snap-failure 2->19         started        signatures3 process4 file5 123 /var/lib/avahi-helper.bak, ELF 15->123 dropped 125 /usr/lib/avahi-helper, ELF 15->125 dropped 127 /root/.bashrc, ASCII 15->127 dropped 129 13 other malicious files 15->129 dropped 137 Found strings related to Crypto-Mining 15->137 139 Sample tries to set files in /etc globally writable 15->139 141 Writes identical ELF files to multiple locations 15->141 143 7 other signatures 15->143 21 reaver.x86.elf exe 15->21         started        23 reaver.x86.elf sh 15->23         started        25 reaver.x86.elf sh 15->25         started        31 16 other processes 15->31 27 snap-failure systemctl 19->27         started        29 snap-failure 19->29         started        signatures6 process7 file8 34 exe exe 21->34         started        36 reaver.x86.elf chattr 21->36         started        39 reaver.x86.elf chattr 21->39         started        50 3 other processes 21->50 41 sh crontab 23->41         started        44 sh 23->44         started        46 sh crontab 25->46         started        131 /tmp/reaver.x86.elf.salt, data 31->131 dropped 48 reaver.x86.elf 31->48         started        52 3 other processes 31->52 process9 file10 54 exe exe 34->54         started        56 exe 34->56         started        59 chattr chattr 34->59         started        69 4 other processes 34->69 153 Protects files from modification 36->153 121 /var/spool/cron/crontabs/tmp.h1qey9, ASCII 41->121 dropped 155 Sample tries to persist itself using cron 41->155 157 Executes the "crontab" command typically for achieving persistence 41->157 61 sh crontab 44->61         started        63 reaver.x86.elf 48->63         started        65 reaver.x86.elf 48->65         started        67 reaver.x86.elf 48->67         started        signatures11 process12 signatures13 71 exe exe 54->71         started        73 exe 54->73         started        76 chattr chattr 54->76         started        80 4 other processes 54->80 165 Protects files from modification 56->165 167 Executes the "crontab" command typically for achieving persistence 61->167 78 reaver.x86.elf 63->78         started        process14 signatures15 82 exe exe 71->82         started        84 exe 71->84         started        87 chattr chattr 71->87         started        89 7 other processes 71->89 169 Protects files from modification 73->169 process16 signatures17 91 exe exe 82->91         started        93 exe chattr 82->93         started        96 exe 82->96         started        98 10 other processes 82->98 159 Protects files from modification 84->159 process18 signatures19 100 exe exe 91->100         started        102 exe chattr 91->102         started        105 exe 91->105         started        107 10 other processes 91->107 171 Protects files from modification 93->171 process20 signatures21 109 exe exe 100->109         started        111 exe chattr 100->111         started        114 exe 100->114         started        116 10 other processes 100->116 161 Protects files from modification 102->161 process22 signatures23 118 exe 109->118         started        173 Protects files from modification 111->173 process24 signatures25 163 Protects files from modification 118->163
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-08-29 02:32:40 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xsscn6ca26hemrv6d3bgiayhr6nvfnocung4e37a3kid6jtppivq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery exection execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260829-c11w2avygs/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Reads system network configuration
Modifies Bash startup script
Creates/modifies Cron job
Creates/modifies environment variables
Enumerates active TCP sockets
Modifies init.d
Modifies rc script
Modifies systemd
Deletes itself
Modifies the /etc/hosts DNS resolution file
Modifies the dynamic linker configuration file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:Linux_Exploit_CVE_2021_4034_1c8f235d
Create hunting rule
Author:Elastic Security
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Mirai_3a56423b
Create hunting rule
Author:Elastic Security
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NSVPS_Hydra_SSH_Bruteforce
Create hunting rule
Author:sanad (NSVPS-SOC)
Description:Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:test_rule_vldslv
Create hunting rule
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:virustotal
Create hunting rule
Author:Tracel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf a874fbca4692d90fd9864bb58df89282abf03e75ea9f87bbd44f5a6416c05faf

Mirai

elf bca426f840d78e4646be1ec26403078f9b52b5c2a34dc26fe0da903f266f7a2b

(this sample)

  
Dropped by
SHA256 a874fbca4692d90fd9864bb58df89282abf03e75ea9f87bbd44f5a6416c05faf
  
URLhaus
https://urlhaus.abuse.ch/url/3909453/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 bbaa9b630bd356c8e1acdc0d462c90b3

Comments