MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac
SHA3-384 hash:	2e9aa32e47db2967a34e82a1ae1a0efc0219904143c248d9312465ea97731313a3c85d71c17a5841a0add5084554d6a3
SHA1 hash:	1221e4e163f3ef9bd79decc2dba303f9b66712e2
MD5 hash:	3b5514868c0ebbeb5666434eaeaa61f7
humanhash:	football-chicken-lima-don
File name:	armv6l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	91'868 bytes
First seen:	2025-11-05 07:08:51 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:QFnRFvNc1otpeJOwtM8GIHus61Co5deJam4gMW37a+iOAZFSpLE7EDQYKyp:eTC0pYo3eJatbZFSpLEgDQI
TLSH	T1B1932A56A8819B11C5C4237AFA2E028D3313277CE3DFB2129E219F2477C695B0DBB956
telfhash	t1c2d0a7c5e63d4adda7e818c416fc2f1a1a8071e391492558dcd5cf1f49d76c7f485130
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 11f61a0222e99cd9d0e93837806335d50ddb02e3a6ced8cdbcc2876a9bb3ebc8

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	45'040 bytes
File size (de-compressed) :	91'868 bytes
Format:	linux/arm
Packed file:	11f61a0222e99cd9d0e93837806335d50ddb02e3a6ced8cdbcc2876a9bb3ebc8

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

rust

Link:

https://www.filescan.io/uploads/690af84185b61a93a736a4ba/reports/c206cbd4-7679-4bc5-82f2-f269e684f968/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2025-11-05T04:17:00Z UTC

Last seen:

2025-11-05T05:16:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Linux.Mirai.b

Link:

https://opentip.kaspersky.com/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0e2261ae-6880-4622-8592-2356ee89feae

Behavior Graph:

Download SVG

Gathering data

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1808348

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-11-05 07:09:42 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ywxmw2vdhkqzfih2lgbu2wicjfqnuden7gaskwknkjgvh7tvswa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/251105-hy5ebsyme1/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/923e8962-170d-40d7-8063-7da521b2e233

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/de2d765b5519d50c9507d2cc1a6ac8124b06d0646fcc092aca6a926a9ff3acac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.