MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9
SHA3-384 hash:	a1950795a60e58688a0130b25ac12bb5b0a26d0a06753edf0c71b2a543a992f870c1a7317b7e179fb36b51c60b8cf49a
SHA1 hash:	0f34b3bfa124b063ff6e9c6fa195e3807f6a74db
MD5 hash:	53f552db641977363bfe62e2cd3263ec
humanhash:	fix-nevada-seven-comet
File name:	nklx86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	83'124 bytes
First seen:	2026-01-24 12:23:49 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:1XozchXm2UxOsyP88ClKhVbqOaZL2jINOGbmQTw+XwHDs8uYe7JO1uD:14o1nUgsc53rQZiIgG6X+gjlzZu
TLSH	T122834AD09642E8F1E9580275227AF3376533D9F801B8FEF7F3945632A426AA0718778D
telfhash	t1e72136f716660ce8bbd06c02e61d63717d0deb7b6160a6b205f31434232ae4754bbc39
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

41

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-7755770-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885259-0

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6974b9f655805a763ff41ff7/reports/3f60be31-0c0a-453c-94ab-36fed5c8be9a/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

36

Number of processes launched:

3

Processes remaning?

false

Remote TCP ports scanned:

23

Full report:

https://elfdigest.com/brief/fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest

Result

Gathering data

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6ba069b2-367c-4010-bcbb-298c7d9ff4f9

Behavior Graph:

Download SVG

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1e1f691d-8933-4246-96b9-485e1fe09241

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1856759

Signature

Drops invisible ELF files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oothqblhyb4w6xypkxrgbmalmdbnfemebmqtote62jrilwkmo4q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260124-q9am4acz9c/

Behaviour

Reads runtime system information

Writes file to shm directory

Enumerates running processes

Deletes itself

Executes dropped EXE

Contacts a large (42806) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb9d33c02b3e03cb7af87aaf1305805b0616948c205909ba64f693142eca63b9