MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930
SHA3-384 hash: 75cafc5ab88aa65b16363d3a84f296360dc7d3a1b0bef8f7e37413dca22fd3ccd2ac474ce73809ae1c7c3dd61b9c48d3
SHA1 hash: 75c3750f47490262e9664680f85f9c289f28655c
MD5 hash: 5ba100e2e157aed9d69c4fca36684c70
humanhash: quiet-kitten-mars-minnesota
File name:sora.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:27'344 bytes
First seen:2026-02-08 02:55:43 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNcTVrhymdX:byNUQUfhQllxlaH0MFjlOnGs6s3UozO
TLSH T157C2E1695228C472A1B44436FDBF01036736CEF8DAEF362A22144734E096E26D6B5B4F
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :27'344 bytes
File size (de-compressed) :70'860 bytes
Format:linux/arm
Unpacked file: 92212628247fe5b2434e748359b1849104d78288078e0d2d1fe9a38744057a45

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ab59ec8d-4aea-4d44-b9af-5a730bd9d55a/
Detection(s):
SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-9955505-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade packed upx
Link:
https://www.filescan.io/uploads/6987fb54981ff1d38a4cba2d/reports/a2e566ca-90bb-473f-9c31-ec23dad4c661/overview
Result
Gathering data
Verdict:
Unknown
File Type:
elf.32.le
Link:
https://opentip.kaspersky.com/d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930/results?tab=lookup
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dcee844-a811-46bb-98a8-e91c62f61d49
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1865438
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1865438 Sample: sora.arm.elf Startdate: 08/02/2026 Architecture: LINUX Score: 72 30 209.109.87.95, 23 WINDSTREAMUS United States 2->30 32 74.10.75.127, 23 WINDSTREAMUS United States 2->32 34 98 other IPs or domains 2->34 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected Mirai 2->42 44 Sample is packed with UPX 2->44 8 sora.arm.elf 2->8         started        10 dash rm 2->10         started        12 dash grep 2->12         started        14 dash rm 2->14         started        signatures3 process4 process5 16 sora.arm.elf 8->16         started        18 sora.arm.elf 8->18         started        21 sora.arm.elf 8->21         started        signatures6 23 sora.arm.elf 16->23         started        26 sora.arm.elf 16->26         started        28 sora.arm.elf 16->28         started        36 Sample tries to kill multiple processes (SIGKILL) 18->36 process7 signatures8 46 Sample tries to kill multiple processes (SIGKILL) 23->46
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3esawny5bh4zxbrpenlmjjcvtlwtuwr3kbr33pfw5l3vyncrfeya._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
upx
Link:
https://tria.ge/reports/260208-de4w8sbs6f/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf d9240b371d09f99b862f2356c4a4559aed3a5a3b5063bdbcb6eaf75c34512930

(this sample)

Mirai

elf 92212628247fe5b2434e748359b1849104d78288078e0d2d1fe9a38744057a45

  
URLhaus
https://urlhaus.abuse.ch/url/3774166/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 92212628247fe5b2434e748359b1849104d78288078e0d2d1fe9a38744057a45
  
Dropping
MD5 1b3a9856ccc1a79b484a829ab6176648

Comments