MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c31e36b0a6679b73bd5353bdb133b09b948d30b2aad71d101e8ec524c22c10a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	c31e36b0a6679b73bd5353bdb133b09b948d30b2aad71d101e8ec524c22c10a5
SHA3-384 hash:	64002088f64ef64af243595dd5e058bec5f7ce241ffaefbc2072fab0f6df4cb053557038da43f16e3f9de17fa9e4b2cf
SHA1 hash:	9eda93c7e68ebc52670af4ca9640717bf1be4fa6
MD5 hash:	fd90f2a7086313c9bf9d2b8af7537d96
humanhash:	king-oven-venus-colorado
File name:	xnxnxnxnxnxnxnxnx86_64xnxn
Download:	download sample
Signature	Mirai Create hunting rule
File size:	136'064 bytes
First seen:	2025-12-21 20:11:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:l5Fbarnk4673Cvsx8AQvk905ouZlX8FsU8YYTj:35sn63CvzrZlXwstnj
TLSH	T143D35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937EE15E15F61
telfhash	t1c331eeb14e9a366812c7a712f319bf69f073150205f1f4e99d376de8ce123824fa30a2
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 dc3376e0b7ca3cf0c63144dc3b36cd74afc74a8835b245c003574f59675d997e

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	63'904 bytes
File size (de-compressed) :	136'064 bytes
Format:	linux/amd64
Packed file:	dc3376e0b7ca3cf0c63144dc3b36cd74afc74a8835b245c003574f59675d997e

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Trojan.Mirai-10056451-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Kills processes

Creating a file in the %temp% directory

Locks files

Runs as daemon

Substitutes an application name

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/694854dfe126b9ff438b024b/reports/c92f7292-9846-44a8-980c-703b6197f401/overview

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2025-12-21T18:26:00Z UTC

Last seen:

2025-12-21T18:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c31e36b0a6679b73bd5353bdb133b09b948d30b2aad71d101e8ec524c22c10a5/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/d5698846-8b09-44c5-bcc0-2eaf061a8002

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6f4a3c1a-f595-4c9b-8bef-2012416c8129

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1837255

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c31e36b0a6679b73bd5353bdb133b09b948d30b2aad71d101e8ec524c22c10a5

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/c31e36b0a6679b73bd5353bdb133b09b948d30b2aad71d101e8ec524c22c10a5/

Threat name:

Linux.Trojan.Etset

Status:

Malicious

First seen:

2025-12-21 20:13:26 UTC

File Type:

ELF64 Little (Exe)

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ympdnmfgm6nxhpktko63cm5qtoki2mfsvllr2ea6r3csjqrmccsq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/251221-yzm5fabq7t/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Checks hardware identifiers (DMI)

Enumerates active TCP sockets

Enumerates running processes

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-10056451-0

YARA:

n/a

Link:

https://app.threat.zone/submission/8049d105-06cc-4491-8df6-c1e421082b25

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.