🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df
SHA3-384 hash: 27f8b57fad44ffb69d3830e23d86b529f4c19a4c85a92647bc237ab16acf57c7c59add4bcf2b6bd2394f5a7ef0648b49
SHA1 hash: 74c3039de1aec61a51d049d93a9cd9e1dc372224
MD5 hash: 28e0dd0efd8d9d5f3abbb2e47b0cadba
humanhash: echo-shade-freddie-hamper
File name:splmips
Download: download sample
Signature Mirai
Create hunting rule
File size:132'448 bytes
First seen:2026-11-11 20:48:10 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:PWyL/WxcR9UyMDVuPVuUmuLOIp0xR9V4BYPuf0vfWjZMVxhikioPSPlEne37FQA:PtaxaMXIpSGfNoiZoP2LFQA
TLSH T175D3DA4F7E529FADF228C2344BB38B35A79527D623E0C285E26CD6015D6028E587FF94
telfhash t13521931c897423f48b355cde2aadfbb5e16130ef0b126c338e51f9acaa6e9425d00c0c
Magika elf
Reporter abuse_ch
Tags:elf mirai torii

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6af4d4c85d195a4fe8c6848c/reports/691cf2af-0e6c-452a-bcb1-61877a93b1c5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4302e3d3-64f2-4ad9-b50f-28622ffb7d30
Behavior Graph:
Download SVG
%3 guuid=54d997a1-1c00-0000-1c87-68b7710c0000 pid=3185 /usr/bin/sudo guuid=f0134ea3-1c00-0000-1c87-68b7750c0000 pid=3189 /tmp/sample.bin guuid=54d997a1-1c00-0000-1c87-68b7710c0000 pid=3185->guuid=f0134ea3-1c00-0000-1c87-68b7750c0000 pid=3189 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/69a34b52-f6ac-4c85-a9bb-94cfd02bff22
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bo4u6w5focfnufc6pijzal36nq2ottt66xzq5hqthxxbkizyhpq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/261111-zljersbz9z/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Changes its process name
Renames itself
Malware Family:
mirai
Create hunting rule
Malicious:
True
Tags:
elf
Link:
https://intel.virussign.com/intelligence/file/f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf f05dca7add2b8456d0a2f3d09c817bf361a74e73f7af9874f099ef70a919c1df

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4059949/

Comments