MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0
SHA3-384 hash: 340669eae6129dc52c9ffd23b0d899f1caa8e1ab3579a8fbc7a461557a93bdf0833f962feebce81807fee543a2b0f759
SHA1 hash: 3c984ac43b6e6578e80ea4002e03d32f01bf13b1
MD5 hash: 41820188846c955a5731ea90caf73e50
humanhash: whiskey-lithium-carpet-alaska
File name:xnxnxnxnxnxnxnxnm68kxnxn
Download: download sample
Signature Mirai
Create hunting rule
File size:126'116 bytes
First seen:2025-10-01 06:03:42 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 3072:4T+kl0NCfI5cDnklIpGKZssRvtrsH4/Qs0o6cQ3:jklK/cDnsIEKZZvtYY/QiQ
TLSH T154C37CC1725D3E6ED6832D3D82428B065E2C9E50AC43191360EDB9471EF76D22F2B6CB
telfhash t1d2b002511fb954f06ac54f7d14411277858f766280f22564ff4dd111303c41fc2cd751
Magika elf
Reporter abuse_ch
Tags:elf gafgyt mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30395.LC.UNOFFICIAL
Create hunting rule

Unix.Dropper.Mirai-7135987-0
Create hunting rule

Unix.Trojan.Gafgyt-10056449-0
Create hunting rule

Unix.Trojan.Mirai-10056451-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gcc lolbin obfuscated remote threat
Link:
https://www.filescan.io/uploads/68dcc467c564c8e81d0b76a6/reports/9380583c-2222-45d1-bb72-28202dd07089/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-10-01T04:44:00Z UTC
Last seen:
2025-10-01T06:24:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/305c2b9c-56e8-4931-a17f-a353aea922b7
Behavior Graph:
Download SVG
%3 guuid=5b20c3de-1800-0000-08bb-fb40520a0000 pid=2642 /usr/bin/sudo guuid=303812e1-1800-0000-08bb-fb405b0a0000 pid=2651 /tmp/sample.bin guuid=5b20c3de-1800-0000-08bb-fb40520a0000 pid=2642->guuid=303812e1-1800-0000-08bb-fb405b0a0000 pid=2651 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b0a2f5ed-2064-4d2f-8466-672f5a9c3ad4
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1787090
Signature
Contains symbols with names commonly found in malware
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
6%
Verdict:
Benign
File Type:
ELF
Link:
https://malprob.io/report/d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 06:04:22 UTC
File Type:
ELF32 Big (SO)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=257awbmbcrcyi44h37r6dwrouzr43ni4p6hq3wd4ykcjaqwwzxya._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251001-gsqhjsbk4x/
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135987-0
YARA:
n/a
Link:
https://app.threat.zone/submission/c3987c87-abaa-4ec7-8fa9-d1c37e2eb6ba
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Linux_Generic_Threat_1ac392ca
Create hunting rule
Author:Elastic Security
Rule name:testlumma
Create hunting rule
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf d77e0b05811445847387dfe3e1da2ea663cdb51c7f8f0dd87cc2849042d6cdf0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3633636/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3633576/

Comments