🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 35664b1b0720aaf383086d2de50e91dbd7fa83f89b8b0dda7d5c1c03ffccc842.

Scan Results

SHA256 hash: 35664b1b0720aaf383086d2de50e91dbd7fa83f89b8b0dda7d5c1c03ffccc842
File size:88'720 bytes
File download: Original
MIME type:application/x-executable
MD5 hash: 0e27fa4fb576da50bbfe15a91e36198b
SHA1 hash: 6775cbcbfc020bf073e0d747d2e70b6519fb8d61
SHA3-384 hash: 260047d5ae2272e70c9c104300dc5bfd91d9f2400061ac3aa6a9ed02b061f4ed48fa28de3c6f6c0fc6750b56b8b666e5
First seen:2026-09-09 02:41:14 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+8:N0bY7lmZH0iL5iNl5GKjVXz38
TLSH :n/a
telfhash : t1d801c96c8eb423e49a368d5a046defa6e1b030da07226c274f15a96caabdc415e05c0d
Create hunting rule
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:ecb9816a-abf7-11f1-b69f-42010aa4000b
File name:35664b1b0720aaf383086d2de50e91dbd7fa83f89b8b0dda7d5c1c03ffccc842.elf
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Sanesecurity.Malware.30435.LC.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Linux.Mirai-63.UNOFFICIAL
Create hunting rule
Signature:Unix.Dropper.Mirai-7135890-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7135897-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7135901-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7135918-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7135939-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7135954-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7136025-0
Create hunting rule
Signature:Unix.Dropper.Mirai-7136028-0
Create hunting rule
Signature:Unix.Trojan.Mirai-7135916-0
Create hunting rule
Signature:Unix.Trojan.Mirai-9819563-0
Create hunting rule
Signature:Unix.Trojan.Mirai-9820623-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
TLP:TLP:WHITE
Repository:Stratosphere
Rule name:MAL_ELF_LNX_Mirai_Oct10_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects ELF malware Mirai related
Reference:Internal Research
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:MAL_ELF_LNX_Mirai_Oct10_2_RID2F3A
Create hunting rule
Author:Florian Roth
Description:Detects ELF malware Mirai related
Reference:Internal Research
TLP:TLP:WHITE
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.