MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 7 File information Comments

SHA256 hash:	d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460
SHA3-384 hash:	5b9ed75fb51b4f37e67a70a6fae8b1161ad301afb81403f74cc213e08581df256589608f11fb52adb0a72f77a6798fb6
SHA1 hash:	f51292506ff3987cf849a7bd785385731ca6da6e
MD5 hash:	6f8beef8585d9ba76e6c2a56ca9b27fe
humanhash:	tennessee-artist-nevada-avocado
File name:	mips
Download:	download sample
Signature	Mirai Create hunting rule
File size:	174'660 bytes
First seen:	2026-07-13 07:56:11 UTC
Last seen:	2026-07-14 02:02:24 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:hYfNwQ2sIONlcvq0KHZol+QJS9Ha+SxSBOnbXG3E:h2NwQ2sIONEtlPe6+70XGU
TLSH	T18C04D60E2E268F2DF7798334D7F78A25965473861EE1C945D2BCF9012E2024D741FBAA
telfhash	t18c21b40c097422e0a7725c9d5aaeff77d56030df1b257d378e01a96da76c9815e10c1c
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creating a file

Sends data to a server

Receives data from a server

Runs as daemon

Kills processes

Opens a port

Collects information on the CPU

Collects information on the RAM

Connection attempt

Performs a bruteforce attack in the network

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/6a549a291b5e82b3b5b0bc3f/reports/8e427823-2ae2-42d0-a4df-787b0e161518/overview

Verdict:

Malicious

Uses P2P?:

true

Uses anti-vm?:

true

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

2323,23

Full report:

https://elfdigest.com/brief/d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460

Behaviour

Anti-VM

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 74.125.250.129:19302

Verdict:

Malicious

File Type:

elf.32.be

First seen:

2026-07-13T05:10:00Z UTC

Last seen:

2026-07-13T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3f952f36-7bba-49a2-a42c-a7948f3374c2

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4c8e8996-81ee-4091-b272-370189a13e84

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2026-07-13 07:57:31 UTC

File Type:

ELF32 Big (Exe)

AV detection:

16 of 36 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2k56faibojppzlp3misn33xx33xicfralvqhbduc7geq3cqocrqa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/260713-jsxb7sfw5s/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	woof_mirai_variant Create hunting rule
Author:	Nokia Deepfield ERT
Description:	Detects Woof Mirai variant (ChaCha20 table, HTTP C2 with token/guid, .woof dropper)
Reference:	Internal analysis of sample 6ef4ce02