MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 6 File information Comments

SHA256 hash:	efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f
SHA3-384 hash:	14bd181230462fb3aadd9155c8269a9c7104b970526bb1dd2311731e7d2cd98039410b084be2c316a4e3b10d3d394ddb
SHA1 hash:	9180733c116975b00f8f171111d5ec0e1aa66e1b
MD5 hash:	4d82a23ad21aa6e6598309ef851209cc
humanhash:	mango-hydrogen-oven-wisconsin
File name:	wife.mpsl
Download:	download sample
Signature	Mirai Create hunting rule
File size:	253'060 bytes
First seen:	2026-09-09 14:18:37 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:yUtMHw5H1/mOpqNLXZ6lJzq8aQr9TkJRzj/ZOZFi:thmOMbmq8aCTkzj/4ZF
TLSH	T18B34B50AAB519FF7D45FDE3305F9870124CCB85321642B3A7270EB5DB95A68B09E38B4
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 de1a06be6a36e42e37721543f516eaf42d34acdce60d95f71dc5d87eeb687f40

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	71'096 bytes
File size (de-compressed) :	253'060 bytes
Format:	linux/mipsel
Packed file:	de1a06be6a36e42e37721543f516eaf42d34acdce60d95f71dc5d87eeb687f40

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Mirai-47.UNOFFICIAL

Sanesecurity.Malware.32133.LX.BOT.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Connection attempt

DNS request

Runs as daemon

Deletes a file

Receives data from a server

Kills processes

Changes access rights for a file

Sends data to a server

Substitutes an application name

Deletes a system binary file

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

bash lolbin masquerade

Link:

https://www.filescan.io/uploads/6aa16b066e9bf5a9d82bb9e4/reports/ccdf52b4-a692-4d57-9eed-24cc72aa9019/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e738d52c-b90c-476a-9d3d-08b0cf076f36

Behavior Graph:

Download SVG

Gathering data

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f/

Threat name:

Linux.Worm.Mirai

Status:

Suspicious

First seen:

2026-09-09 14:16:09 UTC

File Type:

ELF32 Little (Exe)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56373txwvri6fgzq57wly7t4oyvdlo7zfh4aqlms3h7xvmskwf7q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access discovery

Link:

https://tria.ge/reports/260909-rm3wssxyay/

Behaviour

Reads runtime system information

Changes its process name

Reads process memory

Enumerates running processes

Deletes itself

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/efb7fdcef6ac51e29b30efecbc7e7c762a35bbf929f8082d92d9ff7ab24ab17f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202503_elf_Mirai Create hunting rule
Author:	abuse.ch
Description:	Detects Mirai 'TSource' ELF files

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/