MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366
SHA3-384 hash:	0b0e24dda25a05c1aa0a0f80a30bc5ec0ec5656796fea3594f1518e2eb8db7e7c8d376bda9ce9afa4091aef8339045d2
SHA1 hash:	21a4772b6a495f5d406fd2c7ce20c11184c963ae
MD5 hash:	21c6c9d00768f75a0f3a7d2e3db14e41
humanhash:	batman-kentucky-lion-mirror
File name:	arm7
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	58'276 bytes
First seen:	2025-02-19 22:31:11 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:osJkx5TyUYraUfNI9hN0KNqH/SMVcwfGuM9:oZX6I9hmKNqHzfo
TLSH	T15D4328A9BC40E611C5C438FBFA5F42CCB3436768D6E731039F159A3176EB98A0E2E951
telfhash	t1a9b012589b00030742c08440d169093e816520d10d55ae8d030c864f0415d023224937
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

163

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b65cee28ab76d43a5c02b0linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

gcc mirai

Link:

https://www.filescan.io/uploads/67b65f529c5b063ea0a25a74/reports/5be14819-2bc5-4627-8052-e8f8eafe3add/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Intezer Ngioweb

Malware family:

Ngioweb

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/822304ff-190a-4edb-93cd-1ac81e79aa6d

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1619458

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-19 22:32:12 UTC

File Type:

ELF32 Little (Exe)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5p36yrqzl6xezljsjdddaxwx3dfuvivh4h6yy3xjqeeq7qhhunta._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/250219-2fhbmasns4/

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/330336fc-545b-4e38-80b1-ad08031fe595

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ebf7ec46195fae4cad3248c6305ed7d8cb4aa2a7e1fd8c6ee981090fc0e7a366