MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c
SHA3-384 hash: de4320184f443776b379ff03913a48e47d1472b30b4fbf46499b397abe10f2de331231e64fd912e19f070829f7318e44
SHA1 hash: 136282a2faa07b3b6111877648a8d4ab3499ec2c
MD5 hash: 9f680fd891ea359bf379cc5580710233
humanhash: grey-wisconsin-comet-summer
File name:c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c.elf
Download: download sample
Signature Mirai
Create hunting rule
File size:87'636 bytes
First seen:2026-09-01 00:02:16 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:Aw2r81ElKcYDmOwYPX/M7IV4SbAgvvXBVFAAtSqyWCT:MdQDaTY//MsCSUgXxVoT
TLSH T1E3836CD9F683C4F5E81308701037FF36EA72C6FB7268E647D3A85976DC62502A502A9D
telfhash t1653145f919be0ce8e3e09950c20daf223d6de67764a033b145f399312367d4215bac38
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter whack_sh
Tags:elf exe mirai whack.sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Link:
https://research.acce.ciphertechsolutions.com/results/092b520a-3354-4064-b669-636c35dc8487/
Detection(s):
Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30435.LC.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-7100807-0
Create hunting rule

Unix.Dropper.Mirai-7135897-0
Create hunting rule

Unix.Dropper.Mirai-7135901-0
Create hunting rule

Unix.Dropper.Mirai-7135909-0
Create hunting rule

Unix.Trojan.Mirai-7135916-0
Create hunting rule

Unix.Dropper.Mirai-7135918-0
Create hunting rule

Unix.Dropper.Mirai-7135954-0
Create hunting rule

Unix.Dropper.Mirai-7136013-0
Create hunting rule

Unix.Dropper.Mirai-7136016-0
Create hunting rule

Unix.Dropper.Mirai-7136028-0
Create hunting rule

Unix.Dropper.Mirai-7136057-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

Unix.Trojan.Mirai-9441505-0
Create hunting rule

Unix.Trojan.Mirai-9858729-0
Create hunting rule

Unix.Dropper.Mirai-10007027-0
Create hunting rule

Unix.Trojan.Mirai-10009361-0
Create hunting rule

Unix.Trojan.Mirai-10011027-0
Create hunting rule

Unix.Trojan.Mirai-10011918-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Runs as daemon
Receives data from a server
Sends data to a server
Kills critical processes
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b50d0a8d-0034-4c98-acac-9848a1e850c8
Behavior Graph:
Download SVG
%3 guuid=e5c89179-1900-0000-7166-677b630a0000 pid=2659 /usr/bin/sudo guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666 /tmp/sample.bin net guuid=e5c89179-1900-0000-7166-677b630a0000 pid=2659->guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668 /tmp/sample.bin zombie guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666->guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668 clone guuid=4ea152a8-1a00-0000-7166-677b440c0000 pid=3140 /tmp/sample.bin guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666->guuid=4ea152a8-1a00-0000-7166-677b440c0000 pid=3140 clone guuid=3bd858a8-1a00-0000-7166-677b450c0000 pid=3141 /tmp/sample.bin net send-data zombie guuid=2c1c417c-1900-0000-7166-677b6a0a0000 pid=2666->guuid=3bd858a8-1a00-0000-7166-677b450c0000 pid=3141 clone guuid=6811d8e3-1a00-0000-7166-677ba00c0000 pid=3232 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=6811d8e3-1a00-0000-7166-677ba00c0000 pid=3232 clone guuid=968ae1e3-1a00-0000-7166-677ba10c0000 pid=3233 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=968ae1e3-1a00-0000-7166-677ba10c0000 pid=3233 clone guuid=2f8fd987-1c00-0000-7166-677b8d100000 pid=4237 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=2f8fd987-1c00-0000-7166-677b8d100000 pid=4237 clone guuid=ed99cc2a-1e00-0000-7166-677bfc130000 pid=5116 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=ed99cc2a-1e00-0000-7166-677bfc130000 pid=5116 clone guuid=d3521acf-1f00-0000-7166-677b04140000 pid=5124 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=d3521acf-1f00-0000-7166-677b04140000 pid=5124 clone guuid=e82dad72-2100-0000-7166-677b25140000 pid=5157 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=e82dad72-2100-0000-7166-677b25140000 pid=5157 clone guuid=1b577516-2300-0000-7166-677b26140000 pid=5158 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=1b577516-2300-0000-7166-677b26140000 pid=5158 clone guuid=766edbb9-2400-0000-7166-677b27140000 pid=5159 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=766edbb9-2400-0000-7166-677b27140000 pid=5159 clone guuid=f212bd5e-2600-0000-7166-677b28140000 pid=5160 /tmp/sample.bin guuid=82ac937c-1900-0000-7166-677b6c0a0000 pid=2668->guuid=f212bd5e-2600-0000-7166-677b28140000 pid=5160 clone guuid=3bd858a8-1a00-0000-7166-677b450c0000 pid=3141->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con e1aa3a59-4b16-5340-8d56-e386b6628fb9 5.175.222.230:3778 guuid=3bd858a8-1a00-0000-7166-677b450c0000 pid=3141->e1aa3a59-4b16-5340-8d56-e386b6628fb9 send: 5B guuid=e6b1b0a8-1a00-0000-7166-677b460c0000 pid=3142 /tmp/sample.bin net zombie guuid=3bd858a8-1a00-0000-7166-677b450c0000 pid=3141->guuid=e6b1b0a8-1a00-0000-7166-677b460c0000 pid=3142 clone 53ecec69-3b93-567e-a00e-90c32d1d2fd6 10.0.2.1:23 guuid=e6b1b0a8-1a00-0000-7166-677b460c0000 pid=3142->53ecec69-3b93-567e-a00e-90c32d1d2fd6 con
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/37c12adf-fe0a-4091-a72a-85c78876cd78
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-09-01 00:03:18 UTC
File Type:
ELF32 Little (Exe)
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y24lmuyolzb56bmgjc2aas3gvkmszw75vxehtjh75d2w6lenyy6a._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd botnet discovery linux
Link:
https://tria.ge/reports/260901-abp25azhlg/
Behaviour
Reads runtime system information
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
Malware Config
C2 Extraction:
5.175.222.230
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_389ee3e9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_5f7b67b8
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_88de437f
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_8aa7b5d3
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_ae9d0fa6
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_b14f4c5d
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_cc93863b
Create hunting rule
Author:Elastic Security
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3906995/

Comments