MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcf814eac86c19fc2ac51fc4dc23a1896819412e00ffd73d6f415cffa3d5efd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bcf814eac86c19fc2ac51fc4dc23a1896819412e00ffd73d6f415cffa3d5efd3
SHA3-384 hash:	7cbba967a188de45d3a1cbe7a1859f856375c23ac9a621bc99d491cd25ef75cde2fba261e09e95dbb2f73a1d3556ece5
SHA1 hash:	41c41f61bc8c2ccd5f3b3046a342cd0b868d6ffa
MD5 hash:	0543bb89b55aa0f3e197f10aac1e5115
humanhash:	xray-twenty-asparagus-sink
File name:	rep.i486
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	43'820 bytes
First seen:	2025-08-17 19:00:31 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:IB78Zk4cg+2s8+LdS1oy/+QK4PQcyBRkSq4JwT6EIqzPVSfjxTTDj6fnbcuyD7Up:ISZzw81okQ5nkv4KTLLV+dTGfnouy8p
TLSH	T1A113F131FAE999A2E693F27495DFF190ED68712C9ACCC6D9CBC853563450BC07B04A42
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

37

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-10028259-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Receives data from a server

Creating a file

Runs as daemon

Mounts file systems

Opens a port

Sends data to a server

Connection attempt

Substitutes an application name

Performs a bruteforce attack in the network

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade mirai

Link:

https://www.filescan.io/uploads/68a226e7a4bdac9f5b9aa055/reports/c857602e-b462-424b-97fa-ee8ea72b9550/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ee2411a8-76e6-49db-a09f-2d950f0a0103

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1ea8ac73-9758-43c9-9f5f-55cc4de1129a

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1758910

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/bcf814eac86c19fc2ac51fc4dc23a1896819412e00ffd73d6f415cffa3d5efd3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bcf814eac86c19fc2ac51fc4dc23a1896819412e00ffd73d6f415cffa3d5efd3/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-17 07:05:20 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xt4bj2winqm7ykwfd7cnyi5brfubsqjoad75oplpifop7i6v57jq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux rootkit

Link:

https://tria.ge/reports/250817-xn435sxycz/

Behaviour

Loads a kernel module

Contacts a large (27842) amount of remote hosts

Creates a large amount of network flows

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-10028259-0

YARA:

n/a

Link:

https://app.threat.zone/submission/ceaa2700-7bc3-4ad5-81ba-a3b3809923d8

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bcf814eac86c19fc2ac51fc4dc23a1896819412e00ffd73d6f415cffa3d5efd3