MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5
SHA3-384 hash:	991969552bd08ccf1cc7238dcb6c6c9fee1d70ba88467c338aa4fa774ac6f6e2bd70d04b88dc48edb5d2d185f68082b2
SHA1 hash:	c91fdba9de607ae0bb4d745e3cd35ae9af767a9f
MD5 hash:	1cca21719eaf16e5b5a983d3561f6c31
humanhash:	ohio-wyoming-harry-mike
File name:	arm5
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	66'904 bytes
First seen:	2025-06-21 04:42:46 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:iMnIfRsfsNiyjAhO5YoeSyOUarot2AZF/YIBQk5KRr:Oaqi0vGttZF/hhKF
TLSH	T1B7631A52B8809B66D5E016BAFE0E018D33531FF4E2DE72068C15BB3077ABD5A0EBB545
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30456.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-9853181-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9854559-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885101-0

Alert

Create hunting rule

Unix.Malware.Mirai-9896989-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9899908-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685638759cbb19d3c0056600linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creates directories

Creating a file

Sets a written file as executable

Connection attempt

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

39

Number of processes launched:

7

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5998c1f1-face-4cbe-8718-bf76e2995e6e

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bc6398b8-6fdf-4707-a08d-0509cf387bfa

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1719768

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-21 00:07:21 UTC

File Type:

ELF32 Little (Exe)

AV detection:

27 of 38 (71.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xzwmb5h3d6kdjal6n2izlo4olijnuh7vou5ea566yx4axdeiyosq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/250621-fchbkawry4/

Behaviour

Reads runtime system information

File and Directory Permissions Modification

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-9853181-0

YARA:

n/a

Link:

https://app.threat.zone/submission/25a8e841-a62e-4921-bfa0-8f49f33fc3fa

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5