YARAify Scan Results

Task Information

---

Task ID:	d713be76-738d-11f1-ad5e-42010aa4000b
File name:	59e05d55eeccbb41380e1fc456fb84489c7d32d081c65c4bb8aece162e80ca23.elf
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Unix.Trojan.Mirai-9864781-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ELF_Toriilike_persist Alert Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	linux_generic_ipv6_catcher Alert Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses
TLP:	TLP:WHITE
Repository:	Stratosphere

Rule name:	Linux_Generic_Threat_d2dca9e7 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	NET Alert Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	classified
TLP :	TLP:AMBER

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Alert Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	unixredflags3 Alert Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.