MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4
SHA3-384 hash:	2a9bfac14e756ee7af148b293f3b029baa0ebde8bdbfc7a0987745cea3c5b2c236bf65b52ebd1189d4bb3cf963ed6929
SHA1 hash:	53618e2fd7c055d5279fcf117bf84920899e1639
MD5 hash:	e19a3a2db9adfe947aca844e377f9f95
humanhash:	march-mississippi-queen-network
File name:	rizzx.arm5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	25'104 bytes
First seen:	2026-02-26 04:12:52 UTC
Last seen:	2026-02-26 22:33:23 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:fc0uJ5uE3J8+qO8xmdw/kvUj6Xs3UozMx:fc0u2Q++1X4kv4zO
TLSH	T1F5B2D0B0029FBE32D5361478EA30EB4D3286167E61BA3062532407A97EE5A4EB53DC47
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	25'104 bytes
File size (de-compressed) :	56'712 bytes
Format:	linux/arm
Unpacked file:	d5b993666dfdcafcec15f4c261f44e971a5b81681f9a5746a81e78e0c9fb638f

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/beacab45-ae7c-4983-8140-aa7ecc25f559/

Detection(s):

SecuriteInfo.com.Linux.Mirai-18.UNOFFICIAL

Unix.Trojan.Mirai-8274771-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

masquerade packed upx

Link:

https://www.filescan.io/uploads/699fc87697feb4afd65bc328/reports/60334ad3-5a4f-4fc6-8ea8-28c54e3ba97d/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

UPX

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Gathering data

Verdict:

Unknown

File Type:

elf.32.le

Link:

https://opentip.kaspersky.com/e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/dae82e4d-7faf-4f88-8a17-e9e34856de7c

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/960818f7-0eb0-45f8-8144-493099e79ab6

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-02-24 11:38:13 UTC

File Type:

ELF32 Little (Exe)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4w25estflom6yvcrjcsxdpuxhumlzfv2uvfn4d2a2fqjj4d3spsa._file

Result

Malware family:

n/a

Score:

5/10

Tags:

upx

Link:

https://tria.ge/reports/260226-es96vaav2a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.