🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7
SHA3-384 hash: 83d280da9fc0db9c6539562e650a7f012100eab249f403fe83f748ba44f277ec63f32e10d7b22188f04b12911aacb046
SHA1 hash: 3c97bd5bdcfc1ead3f708a41cf5b6b06939b4c11
MD5 hash: 8efe0c77be93c0e4e5b3ad02c823510f
humanhash: lemon-lake-low-ink
File name:kaizen.mpsl
Download: download sample
Signature Mirai
Create hunting rule
File size:310'844 bytes
First seen:2026-08-29 21:24:21 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 6144:rXGSN/vFRTOTzbTln0DCTTE32mWDdPm5X5jRlasdc7/o0TRjmBEqFATj2:LGWFM/Nn0DCfSnWDRY5jRlas2jmBEqaG
TLSH T1F164139C8CA13807EFFD6E7F4A70CD311E89E852CCBED70184F848590779A66A711A4B
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter adliwahid
Tags:mirai UPX
File size (compressed) :310'844 bytes
File size (de-compressed) :717'692 bytes
Format:linux/mipsel
Unpacked file: 808be89c367512e6f3774d16f00c5ab35ce888d13b90293da7ac9741815d684a

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a5136921-20f4-4550-a678-39dd57d7d61f/
Detection(s):
SecuriteInfo.com.Linux.Mirai.10589.3056.3684.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-07-09T23:06:00Z UTC
Last seen:
2026-08-30T21:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/77303ea0-f2aa-4c39-b263-74a6060566ab
Behavior Graph:
Download SVG
%3 guuid=fd223e1f-1900-0000-1730-fbcb2b0c0000 pid=3115 /usr/bin/sudo guuid=38982c22-1900-0000-1730-fbcb2c0c0000 pid=3116 /tmp/sample.bin guuid=fd223e1f-1900-0000-1730-fbcb2b0c0000 pid=3115->guuid=38982c22-1900-0000-1730-fbcb2c0c0000 pid=3116 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ee69c6b8-2cea-4bdc-9b37-df4e674567ff
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-07-10 03:40:59 UTC
File Type:
ELF32 Little (Exe)
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ivzxll556kzowaefn4e2an7rfaxanatnz5r6yvzu77wwt4z33tq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/260829-z9plpavaqc/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Mirai

elf fa2b9bad7def959758042b784d01bf89417034136e7b1f62b9a7ff6b4f99dee7

(this sample)

Mirai

elf 808be89c367512e6f3774d16f00c5ab35ce888d13b90293da7ac9741815d684a

  
Dropping
SHA256 808be89c367512e6f3774d16f00c5ab35ce888d13b90293da7ac9741815d684a
  
Dropping
MD5 d8a3ac8788bc426056349dc96aa44e0f

Comments