MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de
SHA3-384 hash:	af89e68f84e955198ac4faf39a471fd6436e24a0ffeff4ceeaea9d7cec8edbeba769ecb32e013d0a0cb8267faf60a699
SHA1 hash:	879a5a451fada13e01d9fa291f05356ebbd8e5d1
MD5 hash:	be48cc20f3b67aacd3a12249aadd7b98
humanhash:	ceiling-minnesota-cold-florida
File name:	parm5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	18'024 bytes
First seen:	2025-10-19 09:36:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	384:/dm9aWOWi5gLL+odue3llKyx1THGFhymdGUop5h4w8:/YOWiCLqde3lcskFs3Uozl8
TLSH	T1A482AF7250079961D671CE76CD3CC28B1B9A0669E3EA662123D00368625AB076F7D3DB
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	18'024 bytes
File size (de-compressed) :	37'068 bytes
Format:	linux/arm
Unpacked file:	1cac1d75db52dca68f11401508e6ab8ef4d0878891614b0e53e38e652386bd17

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL

Unix.Trojan.Mirai-8274771-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

packed threat upx

Link:

https://www.filescan.io/uploads/68f4b15d3a79800405eacaad/reports/f2d66ff0-fb4f-4a2d-854a-20345748ee8f/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-10-19T06:24:00Z UTC

Last seen:

2025-10-20T14:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6d51d4e5-7c78-4c55-b295-c86c81c63e85

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4ef3c557-5795-4fab-bcb8-be60cfeb9828

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1797881

Signature

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-19 09:30:23 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x6eblh5i75t2sh6jx3toqqykutjeqzolzjmudt45dajhiqkfoppa._file

Result

Malware family:

n/a

Score:

5/10

Tags:

upx

Link:

https://tria.ge/reports/251019-llp1nasjdz/

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/37b356ae-5ead-4b25-94cf-eda7077b8e76

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bf88159fa8ff67a91fc9bee6e8430aa4d24865cbca5941cf9d181274414573de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.