MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835
SHA3-384 hash:	6d6f6f7c1b00def8eeb4d3aece30898b2384aa1e336d4203ec9a8fd71f21039bd3d1ce67a3ead488c042d25261c1bb93
SHA1 hash:	08eda2ee34e5682be4de44fc12aefc2b8dc3aee6
MD5 hash:	376ab457decdf8162fb8037a245309e9
humanhash:	aspen-bluebird-princess-six
File name:	4de1fb
Download:	download sample
Signature	Mirai Create hunting rule
File size:	54'400 bytes
First seen:	2026-06-06 17:08:36 UTC
Last seen:	2026-06-08 06:43:47 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:JdnqNGtwGZ/OrzimUUjEOjeLjI6iR3An4r:OVGlszZUUNt3An4r
TLSH	T1D1330B96B8828A15C5D413BAFE2E118D33236768E3DF7212DE106F14778796F0E7B906
telfhash	t14d01d088cb8c9fe6a7e1dd24c3ee322d3026308af9562d169d275c1603036d0b031089
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Mirai

Details

Link:

https://research.acce.ciphertechsolutions.com/results/942ea0d1-09bb-402b-91ff-d7402a4a440d/

Detection(s):

Unix.Dropper.Mirai-7136025-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-06-06T15:23:00Z UTC

Last seen:

2026-06-06T15:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d3770a5d-b97f-4eec-81ba-05a2c6cfd7c3

Behavior Graph:

Download SVG

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/78081468-c3e9-467e-92f0-e94b2b29d959

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-06-06 17:10:44 UTC

File Type:

ELF32 Little (Exe)

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zenjejkd2dftbyis4du5lvdvs5hkwn7xmthbok5nbihvv75ila2q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet

Link:

https://tria.ge/reports/260606-vpe5asay7z/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Generic_Threat_d2dca9e7 Create hunting rule
Author:	Elastic Security

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/