MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3
SHA3-384 hash:	403e380427463a2bdd125cccbcdeb2675461625365c3c339cfb8c5b4d81958eccc5a690145388a5511d54d917f479d46
SHA1 hash:	7c40d110bd81b3b05c53ec35cafe8a9727141005
MD5 hash:	2144b075c5b4413cfec3703fbf3b62a7
humanhash:	finch-virginia-echo-muppet
File name:	Josho.mips
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	69'080 bytes
First seen:	2025-12-23 22:59:26 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:AHNFnXDuPq/SyZBp9tZI0v6bqfg/Kkz73o2x8WW:gNFXDKGrnI0SWYz73o2OF
TLSH	T1E263961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98
telfhash	t175016d58443817f093814c9d6becff76e09140df59625e3b8d00e99ada26a468d00d2c
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

DE

Vendor Threat Intelligence

ACCE Mirai_Botnet_XOR_Lookup

Malware configuration found for:

Mirai

Details

Mirai

an XOR decryption key and at least a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/860516bf-a170-4a20-8643-cf7ed99ef090/

ClamAV Detected

Detection(s):

Unix.Dropper.Mirai-7135890-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7135939-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7136025-0

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade mirai

Link:

https://www.filescan.io/uploads/694b1f1284afa5547b5d178d/reports/4dd919ac-fd4d-4958-a21d-d83de4e8096f/overview

InQuest

Result

Gathering data

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d4145e13-6ee3-4d2b-ab49-f4239c9b45d1

Behavior Graph:

Download SVG

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3a3aa01e-43d8-42ba-8406-193d94095f89

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1838542

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-23 14:16:51 UTC

File Type:

ELF32 Big (Exe)

AV detection:

25 of 36 (69.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=57fneltcfqo46u35fq2ezgj3fc3hwl7izg34fdytcbm235zhagzq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:josho defense_evasion discovery

Link:

https://tria.ge/reports/251223-2y9tlaxnct/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Modifies Watchdog functionality

Contacts a large (43174) amount of remote hosts

Creates a large amount of network flows

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135890-0

YARA:

n/a

Link:

https://app.threat.zone/submission/f21e7920-af0c-4256-9d98-2467fc525711

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/efcad22e622c1dcf537d2c344c993b28b67b2fe8c9b7c28f131059adf72701b3