MALICIOUS — 303db05754d6665df202765f03ba93c76a31e69c6fa72c4fc63c7d6addfcd6ed.elf

MALICIOUS — 303db05754d6665df202765f03ba93c76a31e69c6fa72c4fc63c7d6addfcd6ed.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 303db05754d6665df202765f03ba93c76a31e69c6fa72c4fc63c7d6addfcd6ed
• SHA-1: c2828fc28bed09a265530fc5ad538e0553cd7036
• MD5: 191de2e3cb5580b016607919d43c1b5c
• ssdeep: 1536:OjneDl6uCA9Ab2aL3QpjrvauDnYQQMcic3nYT56a7y+50RYSs/hr:bwuTA13AjrvauS3nYT56aW+uRi
• TLSH: T109382B167E7954DBF03486C84C844E6C13CE21AD9D28CEEC4F8A6EA35C19A535EB01F6
• Submitted as: 303db05754d6665df202765f03ba93c76a31e69c6fa72c4fc63c7d6addfcd6ed.elf
• File type: elf · Size: 83572 bytes
• Verdict: malicious (86/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-9858729-0
• Microsoft Defender: Backdoor:Linux/Mirai.AW!xp
• Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 86/100 is the fusion of 1 weighted signal:

• ClamAV (daily) flagged Unix.Trojan.Mirai-9858729-0 (rule Unix.Trojan.Mirai-9858729-0) - engine signal, weight 0.90, confidence 0.95

Dynamic analysis

This sample is built for ARM, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report