MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085
SHA3-384 hash:	821ace487eead1d580a129ea1e149a539e81d74849aea0da89166dfbbad008e5af95ceec6c66436e150850b8a41dac92
SHA1 hash:	2840e1cb3f7ea638f3f1f75c7833ab661aa6cc09
MD5 hash:	91755b5b7017603384edefafcb0c6351
humanhash:	utah-alpha-ink-pip
File name:	wife.aarch64
Download:	download sample
Signature	Mirai Create hunting rule
File size:	190'584 bytes
First seen:	2026-09-30 00:08:19 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	3072:OHs8A83tWFgMmneOasGJmxNuffBSxwE4pKhRBezcHFLKuum:OHUYtWS4OasGzfBqwPK9xlOuu
TLSH	T10F147D94DA0EEC92D2C7E2BD6D694BB3703A38E48311D0F75E01635DD9EBED48D96022
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	85'844 bytes
File size (de-compressed) :	190'584 bytes
Format:	linux/arm64
Packed file:	5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Mirai-47.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Creating a file in the %temp% directory

Runs as daemon

Deleting a recently created file

Creating a file

Creates or modifies symbolic links

Changes access rights for a written file

Creates directories

Receives data from a server

Sets a written file as executable

Deletes a file

Locks files

DNS request

Sends data to a server

Deletes a system binary file

Writes files to system directory

Substitutes an application name

Creates or modifies files in /cron to set up autorun

Creates or modifies files in /init.d to set up autorun

Creates or modifies files to set up autorun

Creates or modifies symbolic links in /init.d to set up autorun

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

gcc

Link:

https://www.filescan.io/uploads/6abc53284142835db2dfe7e0/reports/9507df38-4d6a-414e-82ce-7abdacdebd96/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2026-09-29T22:26:00Z UTC

Last seen:

2026-09-30T00:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1607d558-faed-4fe4-aa30-2c2bc2822e41

Behavior Graph:

Download SVG

Gathering data

Score:

77%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-30 00:09:05 UTC

File Type:

ELF64 Little (SO)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yfcfgt45uke4nnhssbjnexxf5fwdiri3svqike66y3u7kmbogccq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260930-afkm7swtc1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_Persistence_Hunt Create hunting rule
Author:	4r4
Description:	Hunts for ELF files with persistence and download capabilities

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087

Mirai

elf c144534f9da289c6b4f29052d25ee5e96c34451b95608513dec6e9f5302e3085

(this sample)

Dropped by

SHA256 5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087

URLhaus

https://urlhaus.abuse.ch/url/3924804/

Delivery method

Distributed via web download

Dropped by

MD5 dc7d3b9428ed4e72dd0d5745a70c2156

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample