MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mozi

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2
SHA3-384 hash:	39765807c90ab16b9025c9524f2aff557f1b5e7ce663701e2e6df154ae30b9edc2acae5825a8930d1c0e28261e93f840
SHA1 hash:	73027876451e434ed851b76e4af842b3300ece4b
MD5 hash:	d30c75b3758a17b9e4300374af590a68
humanhash:	beryllium-orange-cola-virginia
File name:	ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2
Download:	download sample
Signature	Mozi Create hunting rule
File size:	18'980 bytes
First seen:	2026-09-24 11:17:27 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	384:TeV0foxTKXtuvwdtTX9KSyaBSBjeYTfo9mmQPgta8bN4Y75f3M+2d:TDoQtBTX941eYFDgNbl5PY
TLSH	T15C82E0196F03420BDC752EB9655AF446BBAB078A18AB4A94237DC25157F225CA3F030F
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	unknown
Reporter	GAYINT_DOT_ORG
Tags:	cowrie elf honeypot mips mirai Mozi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Unix.Malware.Generic-10008314-0

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ab5070d29b55a61402113f6/reports/eb41adc2-9446-482a-9cdb-f342d07025eb/overview

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2024-09-06T16:40:00Z UTC

Last seen:

2024-11-02T08:49:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b7f5fd8d-1d84-4d5b-8846-ca020d987043

Behavior Graph:

Download SVG

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/cdfaac77-831f-4974-9ed4-0f024d96d114

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2023-11-22 01:20:55 UTC

File Type:

ELF32 Little (Exe)

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=77ba7mpiitunfgtanmy6fuz7bm2r6f37jfi7jbug7x335umsgoza._file

Result

Malware family:

n/a

Score:

8/10

Tags:

upx

Link:

https://tria.ge/reports/260924-nejamscc84/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ffc20fb1e844e8d29a606b31e2d33f0b351f177f4951f48686fdf7bed19233b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Packer_Patched_UPX_62e11c64 Create hunting rule
Author:	Elastic Security
Reference:	https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/