YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6.

Scan Results

SHA256 hash:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6
File size:	153'391 bytes
File download:	Original
MIME type:	application/x-executable
MD5 hash:	fb8243af8ed63bcc06c79255a5f5b15e
SHA1 hash:	476381acd66ffaf8f47c0421f8cbc647b44a28da
SHA3-384 hash:	e14729a51da4a4e6a0afb3283b5b29761713166346cc285d4d060c337db8cf888f7c9bde307cdcbf87e2eafb37828819
First seen:	2025-12-26 20:42:05 UTC
Last seen:	2025-12-26 20:45:38 UTC
Sightings:	5
imphash :	n/a
ssdeep :	3072:YBX1a2Cj0HGV2eZLObIAL5JHL/06d2EnNM/950bEmIPLWxuJf:g1a280HGV2+LO95JHL/9d2ENM/95AEmm
TLSH :	n/a
telfhash :	t170211072a274d1226e208c589e5e9ff2013a87223356ab77ff22e4dc543b4019515c6f Create hunting rule
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 5 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	d5bea8ab-e29b-11f0-9df4-42010aa4000b
File name:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6.elf
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9760303-0 Create hunting rule

Signature:	Unix.Trojan.Mirai-9858729-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

Task Information

Task ID:	c0c213d2-e29b-11f0-9df4-42010aa4000b
File name:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9760303-0 Create hunting rule

Signature:	Unix.Trojan.Mirai-9858729-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via unique string 'npxXoudifFeEgGaACScs'
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	9d6f0d27-e29b-11f0-9df4-42010aa4000b
File name:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9760303-0 Create hunting rule

Signature:	Unix.Trojan.Mirai-9858729-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via unique string 'npxXoudifFeEgGaACScs'
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	7a3cfec0-e29b-11f0-9df4-42010aa4000b
File name:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9760303-0 Create hunting rule

Signature:	Unix.Trojan.Mirai-9858729-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via unique string 'npxXoudifFeEgGaACScs'
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	575123d7-e29b-11f0-9df4-42010aa4000b
File name:	94dc3d1cfc491cf313fccf87873a53c2ff104680e22a552d266319492d3766b6
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9760303-0 Create hunting rule

Signature:	Unix.Trojan.Mirai-9858729-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via unique string 'npxXoudifFeEgGaACScs'
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

YARAify Scan Results

Scan Results Rescan

Tasks

2025-12-26 20:45:38 UTC Static: 6 Unpacker: 0 ClamAV: 2

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-12-26 20:45:03 UTC Static: 6 Unpacker: 0 ClamAV: 2

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-12-26 20:44:03 UTC Static: 6 Unpacker: 0 ClamAV: 2

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-12-26 20:43:04 UTC Static: 6 Unpacker: 0 ClamAV: 2

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-12-26 20:42:06 UTC Static: 6 Unpacker: 0 ClamAV: 2

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results