🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55
SHA3-384 hash: dc0295751e377adb60ac859b67a0d5750d713f5d939f072a43a206b03ef873e0b440091ee0fe4fa54d33280bfe9f0785
SHA1 hash: ca23f7e7de604fcddca5fc90170d926af7f7500d
MD5 hash: 0201b6703b818809f934f37c50feaa41
humanhash: kansas-sink-spring-steak
File name:mips
Download: download sample
Signature Mirai
Create hunting rule
File size:47'348 bytes
First seen:2026-10-14 01:04:13 UTC
Last seen:2026-10-14 21:59:34 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:rbV6wsRDE7vcWWJg6MSNj7kNe7s0ehWK2v54BkqZEnZmDWWwbZnfj:r+DmJSj7kgs0ehWh0jMMDWWwbZnfj
TLSH T16D23745A2E224FECF76C833587B74A31B29823D527F1C688E25CE9015E7420E945F7B9
telfhash t160018c18483813f0e3815c9e6bfcff76e55141eb19266f378e40e9aaeb20a468d00c1c
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
112
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Trojan.Mirai-7100807-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Mounts file systems
DNS request
Connection attempt
Opens a port
Runs as daemon
Substitutes an application name
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6aced531ca1d7071dabbb5a7/reports/d2203d2e-f334-4d70-a4df-44296f81ceb7/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2026-10-13T22:20:00Z UTC
Last seen:
2026-10-15T13:02:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5c5a5800-f74c-46ff-a19a-aecb25c74911
Behavior Graph:
Download SVG
%3 guuid=93a2330e-1b00-0000-553f-6cd0d6090000 pid=2518 /usr/bin/sudo guuid=82969811-1b00-0000-553f-6cd0de090000 pid=2526 /tmp/sample.bin guuid=93a2330e-1b00-0000-553f-6cd0d6090000 pid=2518->guuid=82969811-1b00-0000-553f-6cd0de090000 pid=2526 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/547cffd4-dc6e-42cf-a2ca-e3ebccd47741
Result
Threat name:
Moobot
Create hunting rule
Detection:
malicious
Classification:
spre.troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1986793
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Uses dynamic DNS services
Yara detected Moobot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1986793 Sample: mips.elf Startdate: 14/10/2026 Architecture: LINUX Score: 80 152 wifihgu.duckdns.org 2->152 154 wifihgu.duckdns.org 45.198.224.158, 17691, 45246 VPSVAULTHOSTGB Sweden 2->154 156 daisy.ubuntu.com 91.189.95.56, 35976, 443 CANONICAL-ASGB United Kingdom 2->156 158 Antivirus / Scanner detection for submitted sample 2->158 160 Multi AV Scanner detection for submitted file 2->160 162 Yara detected Moobot 2->162 15 systemd gdm3 2->15         started        17 systemd gpu-manager 2->17         started        19 mips.elf 2->19         started        21 32 other processes 2->21 signatures3 164 Uses dynamic DNS services 152->164 process4 file5 25 gdm3 gdm-session-worker 15->25         started        27 gdm3 gdm-session-worker 15->27         started        37 3 other processes 15->37 29 gpu-manager sh 17->29         started        31 gpu-manager sh 17->31         started        39 6 other processes 17->39 33 mips.elf 19->33         started        150 /var/log/wtmp, data 21->150 dropped 170 Sample reads /proc/mounts (often used for finding a writable filesystem) 21->170 172 Reads system files that contain records of logged in users 21->172 35 accounts-daemon language-validate 21->35         started        41 4 other processes 21->41 signatures6 process7 process8 43 gdm-session-worker gdm-x-session 25->43         started        45 gdm-session-worker gdm-wayland-session 27->45         started        47 sh grep 29->47         started        49 sh grep 31->49         started        51 mips.elf 33->51         started        53 language-validate language-options 35->53         started        55 sh grep 39->55         started        57 sh grep 39->57         started        59 4 other processes 39->59 process9 61 gdm-x-session dbus-run-session 43->61         started        63 gdm-x-session Xorg Xorg.wrap Xorg 43->63         started        65 gdm-x-session Default 43->65         started        67 gdm-wayland-session dbus-run-session 45->67         started        69 mips.elf 51->69         started        72 mips.elf 51->72         started        74 mips.elf 51->74         started        76 language-options sh 53->76         started        signatures10 78 dbus-run-session dbus-daemon 61->78         started        81 dbus-run-session gnome-session gnome-session-binary 1 61->81         started        83 Xorg sh 63->83         started        85 Xorg sh 63->85         started        87 dbus-run-session dbus-daemon 67->87         started        89 dbus-run-session gnome-session gnome-session-binary 1 67->89         started        174 Sample tries to kill multiple processes (SIGKILL) 69->174 176 Sample reads /proc/mounts (often used for finding a writable filesystem) 69->176 91 sh locale 76->91         started        93 sh grep 76->93         started        process11 signatures12 182 Sample tries to kill multiple processes (SIGKILL) 78->182 184 Sample reads /proc/mounts (often used for finding a writable filesystem) 78->184 95 dbus-daemon 78->95         started        97 dbus-daemon 78->97         started        106 9 other processes 78->106 99 gnome-session-binary sh gnome-shell 81->99         started        108 18 other processes 81->108 102 sh xkbcomp 83->102         started        104 sh xkbcomp 85->104         started        110 7 other processes 87->110 112 2 other processes 89->112 process13 signatures14 114 dbus-daemon at-spi-bus-launcher 95->114         started        116 dbus-daemon gjs 97->116         started        166 Sample reads /proc/mounts (often used for finding a writable filesystem) 99->166 119 gnome-shell ibus-daemon 99->119         started        129 9 other processes 106->129 121 gsd-print-notifications 108->121         started        123 gnome-session-check-accelerated gnome-session-check-accelerated-gl-helper 108->123         started        125 gnome-session-check-accelerated gnome-session-check-accelerated-gles-helper 108->125         started        127 dbus-daemon false 110->127         started        131 6 other processes 110->131 process15 signatures16 133 at-spi-bus-launcher dbus-daemon 114->133         started        168 Sample reads /proc/mounts (often used for finding a writable filesystem) 116->168 136 ibus-daemon 119->136         started        138 ibus-daemon ibus-memconf 119->138         started        140 ibus-daemon ibus-engine-simple 119->140         started        142 gsd-print-notifications gsd-printer 121->142         started        process17 signatures18 178 Sample tries to kill multiple processes (SIGKILL) 133->178 180 Sample reads /proc/mounts (often used for finding a writable filesystem) 133->180 144 dbus-daemon 133->144         started        146 ibus-daemon ibus-x11 136->146         started        process19 process20 148 dbus-daemon at-spi2-registryd 144->148         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-10-14 01:10:22 UTC
File Type:
ELF32 Big (Exe)
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3yi7clc7w7qpomzsvyalzy672ovzbj7evwv5p3wkcnc27kgfnkq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
discovery
Link:
https://tria.ge/reports/261014-be6pqadz2s/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Changes its process name
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf bef08f8962fdbf07b999957005e71efe9d5c853f256d5ebf76509a2d7d462b55

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3949834/
  
Delivery method
Distributed via web download

Comments