MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6
SHA3-384 hash: 8f31016b0b8656842dbe2b11f53369d2e54c6e2483695b54d65730bd770f755bc31bdd37455bae803116e2c5adc83790
SHA1 hash: 6451a15fb48c2e6e072d2116f0fad9e20ef1395e
MD5 hash: b66bf80ce288a3053fc28a6626ac7bca
humanhash: jersey-glucose-berlin-single
File name:powerpc
Download: download sample
Signature Mirai
Create hunting rule
File size:69'740 bytes
First seen:2026-08-23 02:11:18 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:+/Rel71zVo72oLOK/ApdqgsDfyiT38ehpjEXRZWjNRap452pV0jN4u+qgw09R:+0vze7//AnqD/MguS5ymN4u+qgwo
TLSH T13D630253D889A993E2F57F7F0910B3D27722CCAE3434DC907B13D580B45E47E2628AA6
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai UPX
File size (compressed) :69'740 bytes
File size (de-compressed) :183'004 bytes
Format:linux/ppc32
Unpacked file: 3d26208888b412e9cec81818669f91dfa17dab1eb8e0876d0a345e187114e8f0

Intelligence

File Origin
# of uploads :
1
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/21c95e16-b0fa-45f1-b03e-0e842e286335/
Detection(s):
Unix.Trojan.Mirai-9936831-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Kills processes
Launching a process
Locks files
Runs as daemon
Sets a file as executable
Creating a file
Substitutes an application name
Kills critical processes
Deleting of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai packed upx
Link:
https://www.filescan.io/uploads/6a8a56fd186385b1b41364e3/reports/77633f80-9e41-43f2-a41f-0b5f20a72b70/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c58c48e5-5fd0-4a12-8790-57da3c18404f
Behavior Graph:
Download SVG
%3 guuid=1947ab9d-1a00-0000-7349-5a72510b0000 pid=2897 /usr/bin/sudo guuid=07878aa1-1a00-0000-7349-5a72560b0000 pid=2902 /tmp/sample.bin guuid=1947ab9d-1a00-0000-7349-5a72510b0000 pid=2897->guuid=07878aa1-1a00-0000-7349-5a72560b0000 pid=2902 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c3c28cde-93ef-4f91-8671-f7bb0dcf81b9
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad.mine
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1962313
Signature
Antivirus / Scanner detection for submitted sample
Deletes system log files
Found strings related to Crypto-Mining
Multi AV Scanner detection for submitted file
Sample deletes itself
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1962313 Sample: powerpc.elf Startdate: 23/08/2026 Architecture: LINUX Score: 84 112 83.168.69.141, 43114, 43116, 43118 SKYPASS-ASPL Poland 2->112 114 daisy.ubuntu.com 2->114 118 Antivirus / Scanner detection for submitted sample 2->118 120 Multi AV Scanner detection for submitted file 2->120 122 Yara detected Mirai 2->122 124 Sample is packed with UPX 2->124 14 powerpc.elf 2->14         started        17 systemd snapd-env-generator 2->17         started        19 systemd snapd-env-generator 2->19         started        signatures3 process4 signatures5 136 Found strings related to Crypto-Mining 14->136 21 powerpc.elf 14->21         started        process6 process7 23 powerpc.elf 21->23         started        signatures8 126 Sample deletes itself 23->126 26 powerpc.elf 23->26         started        29 powerpc.elf 23->29         started        31 powerpc.elf iptables 23->31         started        33 powerpc.elf iptables 23->33         started        process9 signatures10 128 Sample tries to kill multiple processes (SIGKILL) 26->128 130 Deletes system log files 26->130 35 powerpc.elf 26->35         started        37 powerpc.elf 26->37         started        40 powerpc.elf 26->40         started        42 34 other processes 26->42 process11 file12 44 powerpc.elf 35->44         started        47 powerpc.elf 35->47         started        49 powerpc.elf 35->49         started        55 21 other processes 35->55 108 /run/.locker.pid, ASCII 37->108 dropped 51 powerpc.elf 37->51         started        53 powerpc.elf 37->53         started        57 23 other processes 37->57 59 19 other processes 40->59 110 /run/.watchdog.pid, ASCII 42->110 dropped 61 10 other processes 42->61 process13 signatures14 132 Sample tries to kill multiple processes (SIGKILL) 44->132 134 Deletes system log files 44->134 63 23 other processes 44->63 65 17 other processes 47->65 67 16 other processes 49->67 69 17 other processes 51->69 71 17 other processes 53->71 73 26 other processes 55->73 75 28 other processes 57->75 77 20 other processes 59->77 79 4 other processes 61->79 process15 process16 81 powerpc.elf 63->81         started        84 powerpc.elf 63->84         started        86 powerpc.elf 63->86         started        88 25 other processes 63->88 signatures17 116 Sample tries to kill multiple processes (SIGKILL) 81->116 90 powerpc.elf iptables 81->90         started        92 powerpc.elf iptables 81->92         started        94 powerpc.elf iptables 84->94         started        96 powerpc.elf iptables 84->96         started        98 powerpc.elf iptables 86->98         started        100 powerpc.elf iptables 86->100         started        102 powerpc.elf iptables 88->102         started        104 powerpc.elf iptables 88->104         started        106 14 other processes 88->106 process18
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ozl3ne26hjjbvmhddmdeyt45lvk4wuv667pwlj64xufttzsq7la._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260823-cmx8zsdn3y/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf fbb2bdb49af1d290d58718d832627ceaeaae5a95f7befb2d3ee5e859cf3287d6

(this sample)

Mirai

elf 3d26208888b412e9cec81818669f91dfa17dab1eb8e0876d0a345e187114e8f0

  
URLhaus
https://urlhaus.abuse.ch/url/3893505/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 3d26208888b412e9cec81818669f91dfa17dab1eb8e0876d0a345e187114e8f0
  
Dropping
MD5 6481f8189fd0806ac02a1ffcfa686da8

Comments