MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a
SHA3-384 hash:	05c271a42e87996938d033385d77b2c45d0fe144ff5346b28bfcc3189f4de619f47d6999916437d89f503a07b153bb83
SHA1 hash:	69abe18dcd50ede3c903f54c1faf35efdee6bae4
MD5 hash:	4e246c2fd6e59b528ffdafe29e025252
humanhash:	butter-oregon-fanta-five
File name:	mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	118'216 bytes
First seen:	2025-12-03 04:35:31 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	3072:T1y0/ktL/sj+CpW+U92Sw9GtLa3ekR4ORtLsZ8F6/z8/532cndL48EY:hy0/u/f/32SwsAfNsUl2cndLEY
TLSH	T172C3123EEA341267E863F4DD44D7CA268A5769FFED0CCD73520F4A8158EA9097240BB1
Magika	elf
Reporter	abuse_ch
Tags:	elf UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	118'216 bytes
File size (de-compressed) :	291'300 bytes
Format:	linux/mips
Unpacked file:	2d32b13fa3f24ef81aa57117c6ed39a56fa6623ce56ab78dbd0c80ff32aab814

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

No details

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

mirai packed upx

Link:

https://www.filescan.io/uploads/692fbe3eddcd694c78b9dcfb/reports/5f556ce0-b610-40dd-ad98-7d34d0443dbd/overview

Result

Gathering data

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7cf0b4f0-b2e1-44d1-8fec-3a7fd3a2bff1

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

22 / 100

Link:

https://www.joesandbox.com/analysis/1825042

Signature

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y63rg5hjfpsczp2i7rfq7s7t2av4z2q5qyhiyvwjnicym2i3l5fa._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/251203-e8b9rahw9f/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2c0cbdf5-733d-4d2f-a544-1002e1429514

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c7b71374e92be42cbf48fc4b0fcbf3d02bccea1d860e8c56c96a0586691b5f4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	elf_arm_mips_ko_so Create hunting rule

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research