MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1
SHA3-384 hash: f9fe43118247d91560e8569aebf0206553b0cf0ef620af243ac4c5587ffdbf096f698173ce203296c163989e5a92cb91
SHA1 hash: df21fba3436211ecfdc196ca407dc9116fde93b5
MD5 hash: 7c0ad052b19961d97546eefbb898ebd9
humanhash: tennis-may-zulu-mockingbird
File name:Fantazy.m68k
Download: download sample
Signature Mirai
Create hunting rule
File size:72'728 bytes
First seen:2025-12-16 20:20:13 UTC
Last seen:2025-12-17 02:22:41 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:6Zw62k7o8Pl92tktfMGL4hfQJRPB97Sl8pEvK:fVk7XPl92tKMGLkIF9+2EvK
TLSH T121634B99B4018FBCF84BD9FA41254A0EF52162109E530F27B627FED33EA20A6DD47D46
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
3
# of downloads :
100
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Link:
https://research.acce.ciphertechsolutions.com/results/b767ec15-96f7-42e1-98fd-ae687709ba15/
Detection(s):
Unix.Trojan.Mirai-6981989-0
Create hunting rule

Unix.Trojan.Mirai-7135937-0
Create hunting rule

Unix.Dropper.Mirai-7136014-0
Create hunting rule

Unix.Trojan.Mirai-9940650-0
Create hunting rule

Unix.Trojan.Mirai-10018298-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6941bf07e126b9ff43836e50/reports/02f75da4-9386-4ec9-af79-de2cc28357d0/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-12-16T17:42:00Z UTC
Last seen:
2025-12-17T12:24:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0068b4ed-d35d-428a-baec-86f12b3a9a90
Behavior Graph:
Download SVG
%3 guuid=c2896f57-1b00-0000-0459-bcb5270c0000 pid=3111 /usr/bin/sudo guuid=c967195a-1b00-0000-0459-bcb52e0c0000 pid=3118 /tmp/sample.bin guuid=c2896f57-1b00-0000-0459-bcb5270c0000 pid=3111->guuid=c967195a-1b00-0000-0459-bcb52e0c0000 pid=3118 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e8fbb1c3-3f60-4374-830c-ba4cb4ab09f9
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1834359
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1834359 Sample: Fantazy.m68k.elf Startdate: 16/12/2025 Architecture: LINUX Score: 76 134 207.92.177.148, 23 WINDSTREAMUS United States 2->134 136 159.41.29.47, 23 WHIRLPOOL-ASNUS United States 2->136 138 98 other IPs or domains 2->138 146 Malicious sample detected (through community Yara rule) 2->146 148 Antivirus / Scanner detection for submitted sample 2->148 150 Multi AV Scanner detection for submitted file 2->150 12 systemd gdm3 2->12         started        14 systemd gdm3 2->14         started        16 systemd gdm3 2->16         started        18 110 other processes 2->18 signatures3 process4 file5 22 gdm3 gdm-session-worker 12->22         started        24 gdm3 gdm-session-worker 12->24         started        34 5 other processes 12->34 26 gdm3 gdm-session-worker 14->26         started        28 gdm3 plymouth 14->28         started        30 gdm3 gdm-session-worker 16->30         started        36 3 other processes 16->36 132 /var/log/wtmp, data 18->132 dropped 140 Sample reads /proc/mounts (often used for finding a writable filesystem) 18->140 142 Reads system files that contain records of logged in users 18->142 32 gdm3 gdm-session-worker 18->32         started        38 57 other processes 18->38 signatures6 process7 process8 40 gdm-session-worker gdm-wayland-session 22->40         started        42 gdm-session-worker gdm-x-session 24->42         started        44 gdm-session-worker gdm-wayland-session 26->44         started        46 gdm-session-worker gdm-wayland-session 30->46         started        48 gdm-session-worker gdm-wayland-session 32->48         started        50 Fantazy.m68k.elf 38->50         started        53 language-validate language-options 38->53         started        55 language-validate language-options 38->55         started        57 45 other processes 38->57 signatures9 59 gdm-wayland-session dbus-run-session 40->59         started        61 gdm-x-session dbus-run-session 42->61         started        73 2 other processes 42->73 63 gdm-wayland-session dbus-run-session 44->63         started        65 gdm-wayland-session dbus-run-session 46->65         started        67 gdm-wayland-session dbus-run-session 48->67         started        144 Sample tries to kill multiple processes (SIGKILL) 50->144 69 language-options sh 53->69         started        71 language-options sh 55->71         started        75 3 other processes 57->75 process10 process11 82 2 other processes 59->82 84 2 other processes 61->84 86 2 other processes 63->86 88 2 other processes 65->88 77 dbus-run-session dbus-daemon 67->77         started        90 2 other processes 69->90 92 2 other processes 71->92 80 Xorg sh 73->80         started        94 6 other processes 75->94 signatures12 152 Sample reads /proc/mounts (often used for finding a writable filesystem) 77->152 96 sh xkbcomp 80->96         started        98 dbus-daemon 82->98         started        100 dbus-daemon 82->100         started        102 dbus-daemon 82->102         started        110 6 other processes 82->110 104 gnome-session-binary gnome-session-check-accelerated 84->104         started        106 dbus-daemon 86->106         started        108 dbus-daemon 86->108         started        112 5 other processes 86->112 process13 process14 114 dbus-daemon false 98->114         started        116 dbus-daemon false 100->116         started        118 dbus-daemon false 102->118         started        120 dbus-daemon false 106->120         started        122 dbus-daemon false 108->122         started        124 dbus-daemon false 110->124         started        126 dbus-daemon false 110->126         started        128 2 other processes 110->128 130 5 other processes 112->130
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-16 20:21:19 UTC
File Type:
ELF32 Big (Exe)
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3y3iwm5z4p3sdyxsl6vie6vqflm6qngy46nfyazlzarqxhqrowqq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai linux
Link:
https://tria.ge/reports/251216-y4p5lacq8z/
Malware Config
C2 Extraction:
katana.chernobyl.network
Verdict:
Malicious
Tags:
trojan mirai Unix.Trojan.Mirai-6981989-0
YARA:
Linux_Trojan_Mirai_575f5bc8
Link:
https://app.threat.zone/submission/a0218d1f-6287-4038-bfe9-5af5b999b538
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Mirai_575f5bc8
Create hunting rule
Author:Elastic Security
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3734857/
  
Delivery method
Distributed via web download

Comments