MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485
SHA3-384 hash: 5db0ef84ae3bb805bb64f3b051b7d56323ab27bf04759f0bc62957eaa8c336a0537842bf5e41c87c23ba329ba5051596
SHA1 hash: cdff097017bbccc2af6399c55aa2aafd14eae6b2
MD5 hash: fada1c3a4a52038dac243618dcad4f27
humanhash: orange-lion-nebraska-freddie
File name:pppc
Download: download sample
Signature Mirai
Create hunting rule
File size:71'396 bytes
First seen:2025-12-26 16:45:41 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:v7AFs5xxqicS8EWbS1yMUmdnIYWrdIBctCfhGs/Bb:v8mCIrFlnIvr9gb
TLSH T10E634B02B31C0947D1675DB02A3F27E193BEA9D121F8FA89651FDB869271E321186FCD
Magika elf
Reporter abuse_ch
Tags:elf mirai upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 0d6174f47775013a478eeda9ba4b8bcc784314dc05cfb186a1eaa473dc9a55b7
File size (compressed) :33'184 bytes
File size (de-compressed) :71'396 bytes
Format:linux/ppc32
Packed file: 0d6174f47775013a478eeda9ba4b8bcc784314dc05cfb186a1eaa473dc9a55b7

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Mirai
Details
Mirai
an XOR decryption key and at least a c2 socket address
Link:
https://research.acce.ciphertechsolutions.com/results/49875b5b-2c52-4962-bcd9-a70e86aa6fbc/
Detection(s):
Unix.Dropper.Mirai-7135957-0
Create hunting rule

Unix.Trojan.Mirai-9801524-0
Create hunting rule

Unix.Trojan.Mirai-9858729-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/694ebbdde8abb702f8067cd0/reports/d7f3336d-6a07-44e5-b11c-e99b2a44fdf1/overview
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9e0fcca8-44e3-4b3c-863a-c4ef5b1ca1ed
Behavior Graph:
Download SVG
%3 guuid=bf35c013-1a00-0000-c705-af1d61090000 pid=2401 /usr/bin/sudo guuid=0089de16-1a00-0000-c705-af1d65090000 pid=2405 /tmp/sample.bin guuid=bf35c013-1a00-0000-c705-af1d61090000 pid=2401->guuid=0089de16-1a00-0000-c705-af1d65090000 pid=2405 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c2cd3817-2676-4dd3-a780-5e2f534474a5
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1839782
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample deletes itself
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1839782 Sample: pppc.elf Startdate: 26/12/2025 Architecture: LINUX Score: 68 23 169.254.169.254, 80 USDOSUS Reserved 2->23 25 130.12.180.33, 18129, 40050 DATAHOPDatahop-SixDegreesGB Canada 2->25 27 4 other IPs or domains 2->27 29 Antivirus / Scanner detection for submitted sample 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected Mirai 2->33 8 pppc.elf 2->8         started        11 python3.8 dpkg 2->11         started        13 dash rm 2->13         started        15 dash rm 2->15         started        signatures3 process4 signatures5 35 Sample deletes itself 8->35 17 pppc.elf 8->17         started        process6 process7 19 pppc.elf 17->19         started        21 pppc.elf 17->21         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-12-26 16:46:19 UTC
File Type:
ELF32 Big (Exe)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6oadfvdh73yftrvutdetpvsb7eyszjv3ubxe4f6wcftpf4zoiscq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:mirai linux
Link:
https://tria.ge/reports/251226-t951sa1pax/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4e21119b-09d8-4476-92e0-f423e6cb2bac
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:ELF_Toriilike_persist
Create hunting rule
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 0d6174f47775013a478eeda9ba4b8bcc784314dc05cfb186a1eaa473dc9a55b7

Mirai

elf f38032d467fef059c6b498c937d641f9312ca6bba06e4e17d61166f2f32e4485

(this sample)

  
Dropped by
SHA256 0d6174f47775013a478eeda9ba4b8bcc784314dc05cfb186a1eaa473dc9a55b7
  
URLhaus
https://urlhaus.abuse.ch/url/3744080/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 bd453b7aea9dfc0dd4690337681cbb77

Comments