MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e
SHA3-384 hash:	f209ee072f907745907cfaa78d0147b56c5c9ca0967cdfb2f7197e3ac7b238d53a131a82a1917526859e06b7114dd6e1
SHA1 hash:	d44089aa95e55eee505482f7bd326df5fdff8b1f
MD5 hash:	f8783af8cfefd096cb261eae476e737d
humanhash:	sweet-virginia-fourteen-carbon
File name:	arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	138'204 bytes
First seen:	2026-11-15 11:22:16 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:gdnjfOxkUlc3Ny5aTTfz5taIe7Bn+aqIIau3Qiv7Ca2cIol+M7QY52BsMdo0m0S3:S9UENWKTf5cBn+aqZ7Ca2cIiUYAsMmc
TLSH	T190D30956F8819B11E5C151BAFE0E124E77131B7CE3DE72029D24AB34778B8BB0E3A515
telfhash	t1c5e0c277892907d9aac19371404e320f4aa2f1b83612f321add8b75a04225c370bb865
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai torii upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 19a3efa6d21ae12c8b55cb47c595866eda4df93006f43c4816ff891ee0ff7440

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	53'660 bytes
File size (de-compressed) :	138'204 bytes
Format:	linux/arm
Packed file:	19a3efa6d21ae12c8b55cb47c595866eda4df93006f43c4816ff891ee0ff7440

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

bash lolbin rust

Link:

https://www.filescan.io/uploads/6af996201f1c513a93bff2b5/reports/7fef8219-b004-4956-8b2f-295ca3d72706/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d2e58b48-0889-4be1-9b05-9d9f97b23151

Behavior Graph:

Download SVG

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/539f0a06-0db6-47c4-ba13-ca9bf3f8d5cb

Result

Threat name:

Eclipse Botnet

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/2006316

Signature

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Eclipse Botnet

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2026-11-15 11:22:36 UTC

File Type:

ELF32 Little (Exe)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yiqau2vylz54r3sgz27bhcfodx6rlhh4n3q355eugdcfw3jp7cpa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/261115-ng8cjscv2z/

Malware Family:

flooder

Malicious:

True

Tags:

arm elf payload

Link:

https://intel.virussign.com/intelligence/file/c2200a6ab85e7bc8ee46cebe1388ae1dfd159cfc6ee1bef49430c45b6d2ff89e

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_Persistence_Hunt Create hunting rule
Author:	4r4
Description:	Hunts for ELF files with persistence and download capabilities

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/