MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561
SHA3-384 hash:	ba39bf9420dc0a6e2bc981646911d35dcdadf3c0ef291f74ef1e1d1a83a5d795634e6230bf71391dc5c033a4b52a9f6c
SHA1 hash:	8b26cab74728edf6d8f8bda78afa8f59f277ccf0
MD5 hash:	2b194e8179e936e910f0cac1c59e2615
humanhash:	queen-steak-delaware-alaska
File name:	morte.arm5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	25'300 bytes
First seen:	2025-12-03 05:02:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:eoB7q9/ThcrT66e4/fI43bqV0nLs3UozBu:JB7TqiXj3MVzM
TLSH	T1FAB2E071045B38B3C2B0093BE8E4C6B5252B8BB0D2EA72963240C6CC55DE913F5F96D9
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	25'300 bytes
File size (de-compressed) :	59'132 bytes
Format:	linux/arm
Unpacked file:	b8bc0566fdc98dde8c7ff22f813bddaa840c7feae97f3284fd4c1d1b6bf4b257

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

No details

Detection(s):

SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade mirai packed upx

Link:

https://www.filescan.io/uploads/692fc492ddcd694c78b9e33f/reports/de619155-4191-4e68-8c27-cc2187f2abd9/overview

Result

Gathering data

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/55d09c5a-5632-4c8b-b8a9-2f31e1eddb5c

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1825064

Signature

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-12-03 05:03:16 UTC

File Type:

ELF32 Little (Exe)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ocxmn652ajy6gg5s3ubv5b4xvwkpv4gozguhu2buztkq6hwyvqq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

upx

Link:

https://tria.ge/reports/251203-fpsytser8v/

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e3857637ddd0138f18dd96e81af43cbd6ca7d786764d43d341a666a878f6c561

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.