MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd
SHA3-384 hash: 958b38d3c67e4ed4bae0d179e24fa3e8e1d97f085edb21b1e9b98b30e0c3afc93a6e8a9855c06774bd8cff344407bbcd
SHA1 hash: c637f65c020da7c728b5e7cb010732f8e0894c0f
MD5 hash: 087b71f21e8fe441321088b5c9578287
humanhash: hamper-floor-kansas-summer
File name:putita.x86
Download: download sample
Signature Mirai
Create hunting rule
File size:64'756 bytes
First seen:2026-07-29 18:29:28 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 1536:3T+B0k4lbVw83EqhAm7G3c+QTtbIr0iUfxgMnouy8DMF:/xEqhdG3Es0iU+MoutDMF
TLSH T16C530282C0D78BD6EFFD8275849FFC858406B24DFA8026C367DD6234F156B01B664A27
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika unknown
Reporter abuse_ch
Tags:elf UPX
File size (compressed) :64'756 bytes
File size (de-compressed) :148'864 bytes
Format:linux/i386
Unpacked file: cf44153b92da38b641a45988f6bdc1024c8c9482305ca024897a51636ce59d77

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bdb1d4e7-2aa1-46e5-9913-1479edf86385/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Opens a port
Receives data from a server
Sets a written file as executable
Connection attempt
Runs as daemon
Sends data to a server
Creating a file
Creates or modifies symbolic links
Substitutes an application name
Writes files to system directory
Creates or modifies files to set up autorun
Deleting of the original file
Creates or modifies symbolic links in /init.d to set up autorun
Creates or modifies files in /init.d to set up autorun
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade packed upx
Link:
https://www.filescan.io/uploads/6a6a46dedb35c3def4c0730f/reports/6d1309a4-545a-4ad9-9ab3-22016328b7f4/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/90de1775-7260-42e7-a2b2-c98b8672bd80
Behavior Graph:
Download SVG
%3 guuid=85ae42de-1900-0000-030f-7f8f9e080000 pid=2206 /usr/bin/sudo guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208 /tmp/sample.bin delete-file net write-config write-file guuid=85ae42de-1900-0000-030f-7f8f9e080000 pid=2206->guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2329 /tmp/sample.bin guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208->guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2329 clone guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2331 /tmp/sample.bin guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208->guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2331 clone guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2332 /tmp/sample.bin guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208->guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2332 clone guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2333 /tmp/sample.bin net send-data guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2208->guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2333 clone guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2333->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 706d8119-5804-563f-93fb-1ad04086f3d8 64.89.163.215:666 guuid=b5ddafe0-1900-0000-030f-7f8fa0080000 pid=2333->706d8119-5804-563f-93fb-1ad04086f3d8 send: 99B
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d74ba88e-f1ca-4bbe-9995-077d9350622b
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1949729
Signature
Drops files in suspicious directories
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample deletes itself
Sample is packed with UPX
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5b5ypz6mudzdlqd23en5bg4n65qvlk3n2fznj2rsjydkmr32zl6q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux persistence privilege_escalation upx
Link:
https://tria.ge/reports/260729-w47zasssdt/
Behaviour
Reads runtime system information
Changes its process name
Modifies Bash startup script
UPX packed file
Creates/modifies environment variables
Modifies init.d
Modifies rc script
Modifies systemd
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd

(this sample)

Mirai

elf cf44153b92da38b641a45988f6bdc1024c8c9482305ca024897a51636ce59d77

  
URLhaus
https://urlhaus.abuse.ch/url/3892146/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 cf44153b92da38b641a45988f6bdc1024c8c9482305ca024897a51636ce59d77
  
Dropping
MD5 fbc3ba4047f4dfac3af415d332f7e7ea
  
URLhaus
https://urlhaus.abuse.ch/url/3885283/

Comments