MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbcc42e851e7348f826b49a2b2803eb116c5df0d97cbc9e80f8d4763d859adde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fbcc42e851e7348f826b49a2b2803eb116c5df0d97cbc9e80f8d4763d859adde
SHA3-384 hash:	744465d518cd780cac88c9694a969c5accd57b66536688ec048cefca4376022e887781dbfaee4eb723658cc59231e719
SHA1 hash:	c31a64449fb61a37006d2339f861ee9aa9d06259
MD5 hash:	a0e439dd1685410e2b5e8c829082324a
humanhash:	mockingbird-salami-london-glucose
File name:	i686
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	115'996 bytes
First seen:	2025-12-02 17:23:58 UTC
Last seen:	2025-12-02 19:19:01 UTC
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	1536:EakoV5eKAqAD1WcuExlypmneMQpb/QUy1XuxwEvFwVdrPxCyZqgJ9saUBeaorSCX:lUq2WgxQmneBbA+TcrPxBjJCaUBQSCX
TLSH	T159B35A48F787C1F0F68395B1012BD7B72A748926A026FAD5FF893771F8326529D1A21C
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

32

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.io

Gathering data

InQuest

Result

Gathering data

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7cfa3793-ff72-4054-a126-959144b34cbc

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1824706

Signature

Antivirus / Scanner detection for submitted sample

Opens /sys/class/net/* files useful for querying network interface information

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/fbcc42e851e7348f826b49a2b2803eb116c5df0d97cbc9e80f8d4763d859adde

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fbcc42e851e7348f826b49a2b2803eb116c5df0d97cbc9e80f8d4763d859adde/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-02 17:07:25 UTC

File Type:

ELF32 Little (SO)

AV detection:

3 of 36 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7pgef2cr442i7atljgrlfab6welmlxyns7f4t2aprvdwhwczvxpa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/251202-vy21esvpfw/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Changes its process name

Enumerates running processes

Reads MAC address of network interface

Reads network interface configuration

Renames itself

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/37aa74dc-2299-43d8-9ffe-351fe6541c7d

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.