MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64
SHA3-384 hash: 7abec6a6514aa57bc83ce846317deda6c2aa1208c73f5e1b339461998c186a20d6b63842e2f243b63c21eeab1dd7f9a8
SHA1 hash: a594103644620ddcae9fb59c447c9014c59fb30e
MD5 hash: 254149740b03da4412297a92551c40fe
humanhash: finch-twelve-whiskey-beer
File name:morte.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:153'268 bytes
First seen:2025-11-29 09:58:35 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:e0bOY+kdNrsghwiXZj/EX3FlkAJKJnup44gnCtJEosU1APVlF6Dc5mOr1vAoshQ+:e0bOYdNGlllmJYUngJE5NN9AGY
TLSH T142E33945FC829A12C5C727BAF66E028D371623B8D3DE3103DE255F25378A54B0E6BA85
telfhash t1f6e09210de00232c3ba104d492fd5839d62874c935412a94cb7e5f4b5eaadd8741465d
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 ba4f63fad129eb60be3fcf0033d2d256d592845b561e97bbecf1aed54143e805
File size (compressed) :56'344 bytes
File size (de-compressed) :153'268 bytes
Format:linux/arm
Packed file: ba4f63fad129eb60be3fcf0033d2d256d592845b561e97bbecf1aed54143e805

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29524.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30435.LC.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Siggen.9999-6.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-7100807-0
Create hunting rule

Unix.Dropper.Mirai-7135897-0
Create hunting rule

Unix.Dropper.Mirai-7135901-0
Create hunting rule

Unix.Dropper.Mirai-7135909-0
Create hunting rule

Unix.Trojan.Mirai-7135916-0
Create hunting rule

Unix.Dropper.Mirai-7135918-0
Create hunting rule

Unix.Dropper.Mirai-7135954-0
Create hunting rule

Unix.Dropper.Mirai-7136016-0
Create hunting rule

Unix.Dropper.Mirai-7136017-0
Create hunting rule

Unix.Dropper.Mirai-7136028-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

Unix.Trojan.Mirai-9441505-0
Create hunting rule

Unix.Dropper.Mirai-9977145-0
Create hunting rule

Unix.Dropper.Mirai-10007027-0
Create hunting rule

Unix.Trojan.Mirai-10009361-0
Create hunting rule

Unix.Trojan.Mirai-10011027-0
Create hunting rule

Unix.Trojan.Mirai-10011918-0
Create hunting rule

Unix.Trojan.Mirai-10058414-0
Create hunting rule

Unix.Packed.Botnet-6566031-0
Create hunting rule

Unix.Dropper.Botnet-6566040-0
Create hunting rule

Unix.Trojan.Gafgyt-6748839-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gafgyt masquerade mirai obfuscated rust
Link:
https://www.filescan.io/uploads/692ac3f0ab9dcca0c6fbc6ac/reports/232aad64-6050-4101-af55-1189ddd8c811/overview
Result
Gathering data
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c72c9a8-6ac3-4eb3-ae1c-1927f3847303
Result
Threat name:
Mirai, Gafgyt
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1822792
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Detected Mirai
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Malicious sample detected (through community Yara rule)
Manipulation of devices in /dev
Multi AV Scanner detection for submitted file
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1822792 Sample: morte.arm.elf Startdate: 29/11/2025 Architecture: LINUX Score: 100 74 14.100.200.155, 52869, 80, 8080 SINGTELMOBILE-AS-APSINGTELMOBILEINTERNETSERVICEPROVIDER Singapore 2->74 76 167.183.192.188, 52869 SAYFANETTR United States 2->76 78 99 other IPs or domains 2->78 86 Suricata IDS alerts for network traffic 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 Antivirus detection for dropped file 2->90 92 6 other signatures 2->92 12 morte.arm.elf 2->12         started        signatures3 process4 process5 14 morte.arm.elf 12->14         started        process6 16 morte.arm.elf 14->16         started        file7 66 /etc/init.d/sysd, POSIX 16->66 dropped 80 Sample tries to set files in /etc globally writable 16->80 82 Drops files in suspicious directories 16->82 84 Sample tries to persist itself using System V runlevels 16->84 20 morte.arm.elf 16->20         started        22 morte.arm.elf 16->22         started        25 morte.arm.elf sh 16->25         started        signatures8 process9 file10 27 morte.arm.elf 20->27         started        29 morte.arm.elf sh 20->29         started        31 morte.arm.elf 20->31         started        39 3 other processes 20->39 68 /usr/Bin), ELF 22->68 dropped 33 morte.arm.elf sh 22->33         started        35 morte.arm.elf 22->35         started        37 sh cp 25->37         started        process11 process12 57 917 other processes 27->57 41 sh crontab 29->41         started        45 sh 29->45         started        47 morte.arm.elf 31->47         started        49 morte.arm.elf 31->49         started        51 morte.arm.elf 31->51         started        53 sh crontab 33->53         started        55 sh 33->55         started        59 75 other processes 35->59 file13 70 /var/spool/cron/crontabs/tmp.SGajJz, ASCII 41->70 dropped 94 Sample tries to persist itself using cron 41->94 96 Executes the "crontab" command typically for achieving persistence 41->96 61 sh crontab 45->61         started        98 Manipulation of devices in /dev 47->98 100 Deletes system log files 47->100 72 /var/spool/cron/cr...mp.Xs2a7x (deleted), ASCII 53->72 dropped 64 sh crontab 55->64         started        signatures14 process15 signatures16 102 Executes the "crontab" command typically for achieving persistence 61->102
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64/
Threat name:
Linux.Trojan.LnxMirai
Create hunting rule
Status:
Malicious
First seen:
2025-11-29 09:59:12 UTC
File Type:
ELF32 Little (Exe)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=znmnfzyo4d3pwwhhuxpjeg2v7lwrpct2axh5nzljvmzro6whfrsa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai
Link:
https://tria.ge/reports/251129-lz5y2afx6a/
Malware Config
C2 Extraction:
draft21.redirectme.net
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Trojan.Mirai-7100807-0
YARA:
Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024
Link:
https://app.threat.zone/submission/bfbb9ed8-d966-45b4-81a1-f06bd4815b23
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CVE_2017_17215
Create hunting rule
Author:NDA0E
Description:Detects exploitation attempt of CVE-2017-17215
Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:iot_req_metachar
Create hunting rule
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Generic_Threat_1ac392ca
Create hunting rule
Author:Elastic Security
Rule name:Linux_Generic_Threat_d94e1020
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ba4f63fad129eb60be3fcf0033d2d256d592845b561e97bbecf1aed54143e805

Mirai

elf cb58d2e70ee0f6fb58e7a5de921b55faed178a7a05cfd6e569ab33177ac72c64

(this sample)

  
Dropped by
SHA256 ba4f63fad129eb60be3fcf0033d2d256d592845b561e97bbecf1aed54143e805
  
URLhaus
https://urlhaus.abuse.ch/url/3719144/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 ca89f72e71ad82434a2a95f72e39bb19
  
URLhaus
https://urlhaus.abuse.ch/url/3719173/
  
URLhaus
https://urlhaus.abuse.ch/url/3702425/

Comments