MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca
SHA3-384 hash: 7ff98d5a6fd55d3f8d85bb50227332ff366da2f7c90a84a836b4a9fd46d37de561ed583b535cb42c9aa7c31b79cba804
SHA1 hash: 76f54bf48af2a8468243f49014c88173ec5c431a
MD5 hash: ecf649a1347053a24659f0b3fe23bf51
humanhash: alabama-delaware-william-eighteen
File name:goon.x86
Download: download sample
Signature Mirai
Create hunting rule
File size:71'028 bytes
First seen:2026-01-01 19:24:09 UTC
Last seen:2026-01-01 23:22:30 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:e6n35k8SWBN1+19leBlMKHh8xhSmeNM3QH357n/8PplEvzHoJYoRYfS:e6368SWB8qBlMeCShMg3578PpUToHp
TLSH T1A2635BC0A683E8F1E96645B51037A3374B77F53A4079CBCBE774A532AC62A01D62B35C
telfhash t15f31e9f51dae08e8b3d4d804c3196fa13a2ad777255472b544729df433e7e8280bac39
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Unix.Trojan.Mirai-9857931-0
Create hunting rule

Unix.Trojan.Mirai-9866113-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6956c9fe2fb7bb52ca8430c4/reports/d2609646-c25f-47d9-a4cc-b94d490d61db/overview
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-01-01T16:32:00Z UTC
Last seen:
2026-01-03T06:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2e4fec70-a74c-4134-883d-3329b11863b2
Behavior Graph:
Download SVG
%3 guuid=c85b1b17-1e00-0000-8c43-d8ebbb070000 pid=1979 /usr/bin/sudo guuid=2f51ab18-1e00-0000-8c43-d8ebbc070000 pid=1980 /tmp/sample.bin write-file guuid=c85b1b17-1e00-0000-8c43-d8ebbb070000 pid=1979->guuid=2f51ab18-1e00-0000-8c43-d8ebbc070000 pid=1980 execve guuid=9b95652d-1e00-0000-8c43-d8ebbd070000 pid=1981 /tmp/sample.bin dns net send-data write-file zombie guuid=2f51ab18-1e00-0000-8c43-d8ebbc070000 pid=1980->guuid=9b95652d-1e00-0000-8c43-d8ebbd070000 pid=1981 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=9b95652d-1e00-0000-8c43-d8ebbd070000 pid=1981->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 3584B d86bdcf4-b5c5-561c-9d94-b81375785a8a wok.gooning.su:6621 guuid=9b95652d-1e00-0000-8c43-d8ebbd070000 pid=1981->d86bdcf4-b5c5-561c-9d94-b81375785a8a send: 77B
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dbc9e569-8900-4a0a-96bd-750c52ec6788
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1843247
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-01 19:25:25 UTC
File Type:
ELF32 Little (Exe)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4odvr2kll5rkfair5xtm4opnwd243e42fqckcticekvkldfx4lfa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai discovery linux
Link:
https://tria.ge/reports/260101-x4p9xswkbp/
Behaviour
Reads runtime system information
Changes its process name
Traces itself
Malware Config
C2 Extraction:
boats.dogmuncher.xyz
89.190.156.145
Verdict:
Malicious
Tags:
trojan gafgyt mirai Unix.Trojan.Mirai-9857931-0
YARA:
Linux_Trojan_Gafgyt_5bf62ce4 Linux_Trojan_Mirai_b14f4c5d Linux_Trojan_Mirai_5f7b67b8 Linux_Trojan_Mirai_88de437f Linux_Trojan_Mirai_389ee3e9 Linux_Trojan_Mirai_cc93863b Linux_Trojan_Mirai_8aa7b5d3
Link:
https://app.threat.zone/submission/058e6f9b-834f-4ff3-a63a-d51d66932e4b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:Linux_Trojan_Gafgyt_5bf62ce4
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_389ee3e9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_5f7b67b8
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_88de437f
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_8aa7b5d3
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_b14f4c5d
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_cc93863b
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3748680/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3748685/

Comments