MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 14

Intelligence 14 IOCs YARA 12 File information Comments

SHA256 hash:	d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051
SHA3-384 hash:	11aba897a2a592d4dd075e02eb9cd011f1513b2b8b6bdede1889904a0bff6e3394ec5353cacc2c7bbae976ed99af9ca8
SHA1 hash:	04b911ad011040d7ff98f61a1d397019e413ca6a
MD5 hash:	fb39649bb8302b03341e2b6fc68b9973
humanhash:	potato-robert-potato-ohio
File name:	vcimanagement.x86
Download:	download sample
Signature	Mirai Create hunting rule
File size:	91'792 bytes
First seen:	2026-01-11 06:13:59 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:9R4JV4V9147cQodgqUOJ+cmoV9rtqOYWOX+E4W4CzhRUcdc/hOPPagOLVT2O7x6O:9WJV4V9147cQo9UOscmoV9rtbHaPfBhk
TLSH	T199935DC0A683D8F5DD0245B43037EB339A32F179212AE9CBD7D8AA33BC51941951779C
telfhash	t15531d6fd666608d8abd4a912b34fa730fc092aa7046036a618f254253597441a7bbe3d
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Mirai

Details

Mirai

an XOR decryption key and at least a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/5a6de158-3fbd-4d74-8f46-dcf23855d266/

Detection(s):

Sanesecurity.Malware.29524.LC.UNOFFICIAL

Unix.Dropper.Mirai-7135890-0

Unix.Dropper.Mirai-7135939-0

Unix.Dropper.Mirai-7136025-0

Unix.Dropper.Mirai-7355719-0

Unix.Dropper.Mirai-9977145-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade mirai

Link:

https://www.filescan.io/uploads/69633fd240358be74af8de1b/reports/08328a10-e649-4d6b-828a-df5cc99da29d/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-01-11T03:21:00Z UTC

Last seen:

2026-01-11T05:42:00Z UTC

Hits:

~10

Detections:

HEUR:Exploit.Linux.CVE-2017-17215.a HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b

Link:

https://opentip.kaspersky.com/d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/d6433bb0-3aa6-421a-8091-03215202cd2b

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3e4edfb8-ac86-4a63-9840-cff4134fa0ea

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1848275

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-01-11 06:00:52 UTC

File Type:

ELF32 Little (Exe)

AV detection:

24 of 36 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2thup3qpeatasjlqguxjh5ln776274sljkxqjofqtzffd7gk6biq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:echobot family:mirai linux

Link:

https://tria.ge/reports/260111-gzkkwabv8b/

Verdict:

Malicious

Tags:

botnet mirai trojan Unix.Dropper.Mirai-7135890-0

YARA:

MAL_ELF_LNX_Mirai_Oct10_1 Linux_Trojan_Mirai_b14f4c5d Linux_Trojan_Mirai_88de437f Linux_Trojan_Mirai_ae9d0fa6 Linux_Trojan_Mirai_389ee3e9 Linux_Trojan_Mirai_cc93863b Linux_Trojan_Mirai_8aa7b5d3

Link:

https://app.threat.zone/submission/6839b4a6-dbdd-46eb-9b59-51a8d8e6d6d9

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/d4cf47ee0f2026092570352e93f56dfffdaff24b4aaf04b8b09e4a51fccaf051

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CVE_2017_17215 Create hunting rule
Author:	NDA0E
Description:	Detects exploitation attempt of CVE-2017-17215

Rule name:	ELF_Mirai Create hunting rule
Author:	NDA0E
Description:	Detects multiple Mirai variants

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Trojan_Mirai_389ee3e9 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Mirai_88de437f Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Mirai_8aa7b5d3 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Mirai_ae9d0fa6 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Mirai_b14f4c5d Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Mirai_cc93863b Create hunting rule
Author:	Elastic Security

Rule name:	MAL_ELF_LNX_Mirai_Oct10_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects ELF Mirai variant
Reference:	Internal Research