🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3
SHA3-384 hash: d68e93f67e5fcb2ab038402b2db059240959566896771c196e3fcffcd058374d782fe0a1b9be24cc476ac6fb9a6a1d5f
SHA1 hash: 8d315e6afdcc99616be97bd6f072be5f18d960e1
MD5 hash: 98e610daa967885e4d94213adca4d6d1
humanhash: cat-december-sierra-lithium
File name:xmrig-x86
Download: download sample
Signature Mirai
Create hunting rule
File size:9'018'736 bytes
First seen:2026-10-27 13:06:58 UTC
Last seen:2026-10-28 05:59:39 UTC
File type: elf
MIME type:application/x-executable
ssdeep 98304:RQUJmz1E7egWXb0TN2MR/mcJ9dxbEeMTiH8WDZa8AFG+rtr6rDNYM6t7AY0P3qlj:Yu4VWfAuPNrGnl8/X6Kps
TLSH T1DB969E47B9FA04BAC49AC870835FD292BE3074A80161757B7A5866B13F26F305F6EF11
telfhash t125324170cde974b1b6e6ea46f372f076da7214b522f835b015a2bc81dfd0d881c6642e
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter BlinkzSec
Tags:mirai

Intelligence

File Origin
# of uploads :
4
# of downloads :
54
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Detection(s):
PUA.Unix.Coinminer.XMRig-6683890-0
Create hunting rule

Gathering data
Verdict:
Adware
File Type:
elf.64.le
First seen:
2026-10-02T13:55:00Z UTC
Last seen:
2026-10-27T16:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8f6d73fa-a6be-4b85-b864-837ffea75c7a
Behavior Graph:
Download SVG
%3 guuid=03619f1b-1900-0000-61ce-e7e8630d0000 pid=3427 /usr/bin/sudo guuid=72e44b1d-1900-0000-61ce-e7e8680d0000 pid=3432 /tmp/sample.bin mprotect-exec guuid=03619f1b-1900-0000-61ce-e7e8630d0000 pid=3427->guuid=72e44b1d-1900-0000-61ce-e7e8680d0000 pid=3432 execve
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f268ddf6-20db-4349-bbc3-b17e7d52519c
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3/
Threat name:
Linux.Coinminer.XMRig
Create hunting rule
Status:
Malicious
First seen:
2026-10-05 03:29:12 UTC
File Type:
ELF64 Little (Exe)
AV detection:
24 of 36 (66.67%)
Threat level:
  4/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5nkbilx37luu53xzi6zdzkydi3anptluoiwgsxasswzizh24ylbq._file
Result
Malware family:
xmrig_linux
Create hunting rule
Score:
  10/10
Tags:
family:xmrig family:xmrig_linux linux miner
Link:
https://tria.ge/reports/261027-qcssea1y6n/
Behaviour
Family: xmrig
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:ELF_Packer_Dropper_Fileless_Armhf
Create hunting rule
Author:Serhii Kocherhan
Description:Detects obfuscated Linux ELF packers/droppers featuring ChaCha20/RC4 decryption, memfd_create/execveat fileless execution capabilities, and unique binary artifacts.
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:Linux_Trojan_Pornoasset_927f314f
Create hunting rule
Author:Elastic Security
Rule name:MacOS_Cryptominer_Xmrig_241780a1
Create hunting rule
Author:Elastic Security
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:miner_lin_xmrig_strings
Create hunting rule
Author:Sekoia.io
Description:Detects XMRig ELF
Rule name:Multi_Cryptominer_Xmrig_f9516741
Create hunting rule
Author:Elastic Security
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:XMRIG_Monero_Miner
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Monero mining software
Reference:https://github.com/xmrig/xmrig/releases
Rule name:xmrig_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf eb54142efbfae94eeef947b23cab0346c0d7cd74722c695c1295b28c9f5cc2c3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4036015/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4036016/

Comments