MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8
SHA3-384 hash:	66eea22c396900b5c416a5e140a62dfa2ee5bb1e9e5b352f7904a3570eb0c1c58876afbf084cf3ce87c38b2b74e985f2
SHA1 hash:	30f88f2eb7480450da3817016e04433bbfb0c6b2
MD5 hash:	deffd7450bd125655184d31334b0f812
humanhash:	tango-table-connecticut-equal
File name:	zerobot.i686
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	228'204 bytes
First seen:	2026-10-23 12:52:08 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	6144:mRfTZS8KK0iK1Jwpld4sPHBszoH8A38jSskb59Rl9:v8oiK1JklTPHB3xM+LvRl9
TLSH	T1FE24225BB827C456CE42CED2959CE06FEBD13078EFD4E24F8726DD8E86BD4B40991908
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai UPX

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ACCE UPX_ELF_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/87cc254c-c73f-4c7f-ae4f-0b0a2643a23d/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Mirai.9816.21962.4211.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Kills processes

Connection attempt

Changes the time when the file was created, accessed, or modified

Creating a file

Creating a process from a recently created file

Launching a process

Opens a port

Sends data to a server

Sets a written file as executable

Receives data from a server

Runs as daemon

Changes access rights for a written file

Manages services

Creates or modifies files in /cron to set up autorun

Substitutes an application name

Performs a bruteforce attack in the network

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade packed upx

Link:

https://www.filescan.io/uploads/6adb589a7393dbeb370880ba/reports/b506b0ad-a7b5-4890-b721-a74d8a5df7ff/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

1

Number of processes launched:

1

Processes remaning?

false

Remote TCP ports scanned:

2323,5555,23,8080,80,52869,37215,7574,81,49152,8443

Full report:

https://elfdigest.com/brief/f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-10-23T10:28:00Z UTC

Last seen:

2026-10-23T16:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b112d2c3-af82-4d6c-a509-f915697747d2

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/92ce2cfa-8bb5-46f3-8a3c-eb2408e12294

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-23 00:32:35 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 36 (47.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6e57nfy4jzgw34je66d3v7dlkbguocogpijctkfmco47g3tcag4a._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/261023-p3672sbx9s/

Behaviour

Reads runtime system information

Changes its process name

Reads system network configuration

UPX packed file

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies systemd

Writes file to system bin folder

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (47682) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

94.154.43.30

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.82

Link:

https://yomi.yoroi.company/submissions/f13bf6971c4e4d6df124f787bafc6b504d4709c67a1229a8ac13b9f36e6201b8