MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361
SHA3-384 hash:	a4c81b6b78356e236c615344f8575825e78fa64f2c82279218881e284ed73ea6e875c8c0789d77a60fa6d8cd6ff7bcc2
SHA1 hash:	d5902431241c15ab78413835f1304ced2b5f82f1
MD5 hash:	012904e234b0ae6a378fd015ddbcad9f
humanhash:	item-sweet-timing-carbon
File name:	arm6
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	66'476 bytes
First seen:	2025-02-19 22:01:11 UTC
Last seen:	2025-02-20 21:15:05 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:2vPUJBGBU7ZxhPGvdaFeARFiXQQNTNnu8iqyUOATX51HUqY2Q0+Fkn2qN:6FdaF/iXfNnuVATr1+QP
TLSH	T1FF5307A9B89DDA5AC1C020F6B94E168C33476778D1E733129E24DB3262EF54B8F3D941
telfhash	t156b0120cb3400b184398465041d52a360596308c05149c88c72817080554c41b112830
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

139

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b655a6a0fd713c335bde64linux22vpnfull_triage

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

gcc mirai

Link:

https://www.filescan.io/uploads/67b6556a33fedf5228372a81/reports/a2aa8e8f-7fd8-4d71-8653-f108093dec5b/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Intezer Ngioweb

Malware family:

Ngioweb

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1f65acb-c6ee-4ff7-a812-904fb502755f

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1619441

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-19 21:47:28 UTC

File Type:

ELF32 Little (Exe)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7n52o6axztjd4mllruoomyj7ussyepwdoewzl45zavpbixsvqnqq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/250219-1xvslszmet/

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ef8b0b8e-3dd7-4a98-84b8-6dc7071f9d84

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fb7ba77817ccd23e316b8d1ce6613fa4a5823ec3712d95f3b9055e145e558361