MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cddb91f6fd9264f7e8de0b059be80a39d0cd347980ad462b08da2585984f779c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	cddb91f6fd9264f7e8de0b059be80a39d0cd347980ad462b08da2585984f779c
SHA3-384 hash:	c7352d32045f1040474221a71ee8ec1d3053f6e9716e0446f627180f8cdd3bda154e88d41dc104d91c61c92e604dbe71
SHA1 hash:	eec0341dbbe0c2253c76488962418deea307335c
MD5 hash:	fc3449473405ab1d24125c979204cb71
humanhash:	mississippi-leopard-bacon-foxtrot
File name:	sdxkzX_UNXPOE282.ppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	52'568 bytes
First seen:	2026-02-02 18:26:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:3ldxE/ia9ByAf6rNhvp9OdAsWu/scQ4q3+o8wYk10:3S9VuN0ACsHV3/dYl
TLSH	T18F334B4232180E47E0575FB0393F17E093BEED9120E5F648AA4FAB55C639E724986F8D
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 0a32faccc516d4ac73178065e47d1549f2e7badb939c28aacf9c97eef22b15c6

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	23'704 bytes
File size (de-compressed) :	52'568 bytes
Format:	linux/ppc32
Packed file:	0a32faccc516d4ac73178065e47d1549f2e7badb939c28aacf9c97eef22b15c6

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Mirai

Details

Mirai

an XOR decryption key and at least a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/da2ebb81-ab8f-4c4f-834b-2492e82b9e20/

Detection(s):

Unix.Dropper.Mirai-7135957-0

Unix.Trojan.Mirai-9441505-0

Unix.Trojan.Mirai-9940367-0

Unix.Trojan.Mirai-10012201-0

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f94b7f20-d666-4238-88bd-e0a50c99e0f0

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b24aba76-435f-4c22-b36c-7324f02c6f31

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1861890

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/cddb91f6fd9264f7e8de0b059be80a39d0cd347980ad462b08da2585984f779c

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/cddb91f6fd9264f7e8de0b059be80a39d0cd347980ad462b08da2585984f779c/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-02-02 18:27:44 UTC

File Type:

ELF32 Big (Exe)

AV detection:

21 of 36 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zxnzd5x5sjspp2g6bmczx2akhhim2ndzqcwumkyi3isylgcpo6oa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:amen linux

Link:

https://tria.ge/reports/260202-w315cshs5h/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.