MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567
SHA3-384 hash:	fe5606a191a0ad3e85f33a0a05017353a9a1392d2588354eea913591c595bc7e0fdb15ebead94876328e463b1cb73750
SHA1 hash:	dccd6653391fe13ad31055db5cd1b4dd095788ac
MD5 hash:	091316933132f338ee7a89e1b6332f7a
humanhash:	tango-edward-sierra-butter
File name:	morte.arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	91'952 bytes
First seen:	2025-07-11 06:17:16 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:j9fn4DkAeKL/3tpg0q5hkJueJCJ5EHvaIHu6VVzwUDilBFapJ77uRY1iN:jODkAZg0qo4ekJuHvaIHwBFapJ7iR9
TLSH	T1A7932956FD819B21D5C102BAFA1E118E3313177CE2EE73129D186F21778B96B0E7B816
telfhash	t18521f14689d01edc35d0936ac2ee627fa9f43a986b153145872d7b0d5336fd63520835
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 9eaf411809712da0d03ab500ea94743856d6674903dedf2cd81012b5cf458d1a

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	43'164 bytes
File size (de-compressed) :	91'952 bytes
Format:	linux/arm
Packed file:	9eaf411809712da0d03ab500ea94743856d6674903dedf2cd81012b5cf458d1a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6870aca6c9eb9747376843b8linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

masquerade rust

Link:

https://www.filescan.io/uploads/6870aca52f482f87cbf7c160/reports/3bc7ca72-bb2d-47eb-9cc8-d165763bbc7c/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/08fedc44-e96b-4ed2-9f25-5709dec2d82e

Behavior Graph:

Download SVG

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/52a23e38-1567-418f-851b-d9b4c541f828

Result

Threat name:

Mirai, Xmrig

Detection:

malicious

Classification:

troj.mine

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1733368

Signature

Found strings related to Crypto-Mining

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567/

Verdict:

Malicious

Threat:

Linux.Worm.Mirai

Link:

https://tip.neiki.dev/file/f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-07-11 06:18:14 UTC

File Type:

ELF32 Little (Exe)

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6dy57mmwbssytgfvguk6o7dezciqpsb26g7pogktrt5taptfgvtq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/250711-g2lwqafl5t/

Malware Config

C2 Extraction:

abc.izumisv1.cc

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/cf26d53c-3ec7-4953-be0c-40ae1cc09e0c

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f0f1dfb1960ca58998b53515e77c64c89107c83af1bef719538cfb303e653567

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.