YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c.

Scan Results


SHA256 hash: ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c
File size:203'746 bytes
File download: Original
MIME type:application/x-executable
MD5 hash: 10ca536e82aa923cd29eea3d79d2b017
SHA1 hash: 47b00e2fcb9efe48427884620d6839476ee8ac41
SHA3-384 hash: 4759d5528d03ca4d9fad20a1ea8a77a6e27ebb3f13d5a00c66b6979c9270090add300c12735c811c46732b0bffdaf0fa
First seen:2026-04-02 15:55:01 UTC
Last seen:2026-04-02 16:09:23 UTC
Sightings:6
imphash :n/a
ssdeep : 6144:CiDbm+KNe8W8ayGeVOKN387Aq+CHRPV/G7l:CQmXe8W8ayGeVOKpYtt/I
TLSH :n/a
telfhash : t1d2311061993812252a61ec18ec6957f3492787261750bb35ef36c8cc380f44af636c1f
gimphash :n/a
dhash icon :n/a

Tasks


There are 6 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information


Task ID:50bdc87b-2eae-11f1-b47f-42010aa4000b
File name:ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c.elf
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.

Task Information


Task ID:de1a5f24-2eac-11f1-b47f-42010aa4000b
File name:net-workd
Task parameters:ClamAV scan:True
Unpack:True
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.

Task Information


Task ID:ba6b35d1-2eac-11f1-b47f-42010aa4000b
File name:net-workd
Task parameters:ClamAV scan:True
Unpack:True
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.

Task Information


Task ID:96e799a6-2eac-11f1-b47f-42010aa4000b
File name:net-workd
Task parameters:ClamAV scan:True
Unpack:True
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.

Task Information


Task ID:73415b8f-2eac-11f1-b47f-42010aa4000b
File name:net-workd
Task parameters:ClamAV scan:True
Unpack:True
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.

Task Information


Task ID:4edf3d5d-2eac-11f1-b47f-42010aa4000b
File name:net-workd
Task parameters:ClamAV scan:True
Unpack:True
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Unix.Dropper.Mirai-7135897-0
Signature:Unix.Dropper.Mirai-7135901-0
Signature:Unix.Dropper.Mirai-7135909-0
Signature:Unix.Dropper.Mirai-7135918-0
Signature:Unix.Dropper.Mirai-7135925-0
Signature:Unix.Dropper.Mirai-7135954-0
Signature:Unix.Dropper.Mirai-7136016-0
Signature:Unix.Dropper.Mirai-7136028-0
Signature:Unix.Trojan.Mirai-10059006-0
Signature:Unix.Trojan.Mirai-10059216-0
Signature:Unix.Trojan.Mirai-7100807-0
Signature:Unix.Trojan.Mirai-7135916-0
Signature:Unix.Trojan.Mirai-8025795-0
Signature:Unix.Trojan.Mirai-9760303-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_Script_Inject_Detector
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:ELF_Toriilike_persist
Author:4r4
Description:Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:Identified via researched data
TLP:TLP:WHITE
Repository:YARAify
Rule name:enterpriseapps2
Author:Tim Brown @timb_machine
Description:Enterprise apps
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:classified
TLP :TLP:AMBER
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_XORed_Mozilla_Oct19
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.