AI
Mirai botnet malware binary
Local reference
Suspicious dependency
Inferred
Mirai SORA credential bot with reflection DDoS: lkxstress.arm5:0x13f4c
IoT reflection bot with static uClibc tables: lkxstress.arm5:0x13f4c
Mirai SORA credential brute force with VSE flood: lkxstress.arm5:0x144c8
| 0x0 | 7f454c46010101610000000000000000 | .ELF...a........ |
| 0x10 | 02002800010000009081000034000000 | ..(.........4... |
| 0x20 | 74640100020000003400200003002800 | td......4. ...(. |
| 0x30 | 0c000b00010000000000000000800000 | ................ |
| 0x40 | 00800000406001004060010005000000 | ....@`..@`...... |
| 0x50 | 00800000010000004060010040600200 | ........@`..@`.. |
| 0x60 | 40600200e40300005c3b000006000000 | @`......\;...... |
| 0x70 | 0080000051e574640000000000000000 | ....Q.td........ |
| 0x80 | 00000000000000000000000007000000 | ................ |
| 0x90 | 040000000dc0a0e1f0df2de904b04ce2 | ..........-...L. |
| 0xa0 | 220000eb784e00ebf0af1be900000000 | "...xN.......... |
| 0xb0 | 30402de95c509fe50030d5e5000053e3 | 0@-.\P...0....S. |
| 0xc0 | 3080bd1850409fe5003094e5002093e5 | 0...P@...0... .. |
| 0xd0 | 000052e30700000a043083e2003084e5 | ..R......0...0.. |
| 0xe0 | 0fe0a0e102f0a0e1003094e5002093e5 | .........0... .. |
| 0xf0 | 000052e3f7ffff1a20309fe5000053e3 | ..R..... 0....S. |
| 0x100 | 1c009f150fe0a01103f0a0110130a0e3 | .............0.. |
| 0x13ecc | 2f7833382f78464a2f7839332f784944 | /x38/xFJ/x93/xID |
| 0x13edc | 2f7839412f7833382f78464a2f783933 | /x9A/x38/xFJ/x93 |
| 0x13eec | 2f7849442f7839412f7833382f78464a | /xID/x9A/x38/xFJ |
| 0x13efc | 2f7839332f7849442f7839412f783338 | /x93/xID/x9A/x38 |
| 0x13f0c | 2f78464a2f7839332f7849442f783941 | /xFJ/x93/xID/x9A |
| 0x13f1c | 000000000d0a0d0a00000000534e5155 | ............SNQU |
| 0x13f2c | 4552593a203132372e302e302e313a41 | ERY: 127.0.0.1:A |
| 0x13f3c | 41414141413a78737672000002000000 | AAAAA:xsvr...... |
| 0x13f4c | 4d2d534541524348202a20485454502f | M-SEARCH * HTTP/SSDP amplification bot behavior |
| 0x13f5c | 312e310d0a484f53543a203235352e32 | 1.1..HOST: 255.2Mirai SORA credential bot with reflection DDoS |
| 0x13f6c | 35352e3235352e3235353a313930300d | 55.255.255:1900. |
| 0x13f7c | 0a4d414e3a2022737364703a64697363 | .MAN: "ssdp:discSSDP/procfs IoT bot with covert C2 markers |
| 0x13f8c | 6f766572220d0a4d583a20310d0a5354 | over"..MX: 1..STIoT reflection bot with static uClibc tables |
| 0x13f9c | 3a2075726e3a6469616c2d6d756c7469 | : urn:dial-multi |
| 0x13fac | 73637265656e2d6f72673a7365727669 | screen-org:servi |
| 0x13fbc | 63653a6469616c3a310d0a555345522d | ce:dial:1..USER- |
| 0x13fcc | 4147454e543a20476f6f676c65204368 | AGENT: Google Ch |
| 0x13fdc | 726f6d652f36302e302e333131322e39 | rome/60.0.3112.9 |
| 0x13fec | 302057696e646f77730d0a0d0a000000 | 0 Windows....... |
| 0x13ffc | 96130010c2781337cafe010000000064 | .....x.7.......d |
| 0x1400c | 6973636f002072640000000001000001 | isco. rd........ |
| 0x1401c | 0000000000000377777706676f6f676c | .......www.googl |
| 0x1402c | 6503636f6d0000010001000001000001 | e.com........... |
| 0x1403c | 0000000000000377777706676f6f676c | .......www.googl |
| 0x1404c | 6503636f6d0000050001000072fe1d13 | e.com.......r... |
| 0x1405c | 0000000000000002000186a00001977c | ...............| |
| 0x1406c | 00000000000000000000000000000000 | ................ |
| 0x1407c | 0000000000000000d9000afa00000000 | ................ |
| 0x1408c | 00010290000000000000000000000000 | ................ |
| 0x1409c | 00000000000000000000000000000000 | ................ |
| 0x140ac | c50204ecec42ee9200000000303a0201 | .....B......0:.. |
| 0x140bc | 03300f02024a690203 | .0...Ji.. |
| 0x14448 | a0c2010058c301000210010820021001 | ....X....... ... |
| 0x14458 | 0820000056000e0f8c8d8e8f11129392 | . ..V........... |
| 0x14468 | a9aa0e7d7e7f80818283848586878896 | ...}~........... |
| 0x14478 | 9798999a9b9c9d9e9fa0a1a2a3a4a5a6 | ................ |
| 0x14488 | a7a87e7f8081828384969798999a9b9f | ..~............. |
| 0x14498 | a0a1a2006d616c6c6f630000c006ce30 | ....malloc.....0 |
| 0x144a8 | 00000000539b000044520000414e4d57 | ....S...DR..ANMW |
| 0x144b8 | 4646585b5543514a4750472200000000 | FFX[UCQJGPG".... |
| 0x144c8 | 273c313838540000313a353638315400 | '<188T..1:5681T.Mirai SORA credential bot with reflection DDoS |
| 0x144d8 | 272d272031395400273c54007b363d3a | '-' 19T.'<T.{6=: |
| 0x144e8 | 7b3621272d363b2c741b0315061d5400 | {6!'-6;,t.....T. |
| 0x144f8 | 1b0315061d6e74352424383120743a3b | .....nt5$$81 t:; |
| 0x14508 | 2074323b213a3054000000003a373b26 | t2;!:0T....:7;&Mirai SORA credential brute force with VSE flood |
| 0x14518 | 26313720540000007b363d3a7b362127 | &17 T...{6=:{6!' |
| 0x14528 | 2d363b2c74242754000000007b363d3a | -6;,t$'T....{6=: |
| 0x14538 | 7b3621272d363b2c743f3d383874796d | {6!'-6;,t?=88tym |
| 0x14548 | 745400002d62602d414d0000c2e80528 | tT..-b`-AM.....( |
| 0x14558 | 000000007b323054000000007b393524 | ....{20T....{95$ |
| 0x14568 | 275400007b24263b377b3a31207b2037 | 'T..{$&;7{:1 { 7 |
| 0x14578 | 245400007b2720352021275400000000 | $T..{' 5 !'T.... |
| 0x14588 | 7a353a3d393154007b24263b377b3a31 | z5:=91T.{$&;7{:1SSDP/procfs IoT bot with covert C2 markers |
| 0x14598 | 207b263b212031540000000035272723 | {&;! 1T....5''# |
| 0x145a8 | 3b263054000000007b373930383d3a31 | ;&0T....{7908=:1 |
| 0x145b8 | 540000002039247b5400000030352035 | T... 9${T...05 5 |
| 0x145c8 | 7b383b373538540025202c363b205400 | {8;758T.% ,6; T. |
| 0x145d8 | 7a5400003526395400000000363b2054 | zT..5&9T....6; T |
| 0x145e8 | 000000002c6c625400000000273c6054 | ....,lbT....'<`T |
| 0x145f8 | 00000000393d24275400000039242738 | ....9=$'T...9$'8 |
| 0x14608 | 54000000273035540000000039203054 | T...'05T....9 0T |
| 0x14618 | 000000003c353f353d5400007b312037 | ....<5?5=T..{1 7 |
| 0x14628 | 7b2631273b38227a373b3a3254000000 | {&1';8"z7;:2T... |
| 0x14638 | 3a353931273126223126745400000000 | :591'1&"1&tT.... |
| 0x14648 | 7b3031227b233520373c303b33540000 | {01"{#5 7<0;3T.. |
| 0x14658 | 7b3031227b393d27377b233520373c30 | {01"{9='7{#5 7<0 |
| 0x14668 | 3b335400243636322a37214500000000 | ;3T.$662*7!E.... |
| 0x14678 | 3b333d3a54000000313a203126540000 | ;3=:T...1: 1&T.. |
| 0x14688 | 6d2165666760606c2165666035216c65 | m!efg``l!ef`5!le |
| 0x14698 | 6030602c6564540028d785f85458a600 | `0`,edT.(...TX.. |
| 0x146a8 | 2b64163bf72b47a1c8320000bd914ff6 | +d.;.+G..2....O. |
| 0x146b8 | 0edb8c17000000009aea183900000000 | ...........9.... |
| 0x146c8 | 6260b4008ef80f210000000088ee1522 | b`.....!......." |
| 0x146d8 | 0000000050628843c90000004e629e4c | ....Pb.C....Nb.L |
| 0x146e8 | c90000006a77c400777cc4006e7d752b | ....jw..w|..n}u+ |
| 0x146f8 | 4c62000028d483f64302e4004d7d9449 | Lb..(...C...M}.I |
| 0x14708 | 8700000012659240d8000000c2e9183b | .....e.@.......; |
| 0x14718 | 00000000c2fb1c3f00000000e35c7e43 | .......?.....\~C |
| 0x14728 | 9f83a1132932c8ef00000000d40b59f4 | ....)2........Y. |
| 0x14738 | f804586e37dd44de632e00002a67ab00 | ..Xn7.D.c...*g.. |
| 0x147bd | 3754003d2627273d5400003621272d36 | 7T.=&''=T..6!'-6 |
| 0x147cd | 3b2c540000000027273c540000000027 | ;,T....''<T....' |
| 0x147dd | 372454000000002031383a3120540024 | 7$T.... 18:1 T.$ |
| 0x147ed | 31263854000000242d203c3b3a540026 | 1&8T...$- <;:T.& |
| 0x147fd | 21362d54000000382135540000000033 | !6-T...8!5T....3 |
| 0x1480d | 3036540000000027202635373154003d | 06T....' &571T.= |
| 0x1481d | 2420353638312754000000242754003f | $ 5681'T...$'T.? |
| 0x1482d | 3d383854000000323d3a305400000000 | =88T...2=:0T.... |
| 0x1483d | 073b2126373174113a333d3a31740521 | .;!&71t.:3=:1t.! |
| 0x1484d | 31262d5400000072656164646972002f | 1&-T...readdir./ |
| 0x1485d | 70726f630000006f70656e6469720077 | proc...opendir.w |
| 0x1486d | 35713668653364627273676d636c6b69 | 5q6he3dbrsgmclki |
| 0x1487d | 7534746f31386e7061766a3730326600 | u4to18npavj702f. |
| 0x1488d | 0000006162636465666768696a6b6c6d | ...abcdefghijklm |
| 0x1489d | 6e6f707172737475767778797a414243 | nopqrstuvwxyzABC |
| 0x148ad | 4445464748494a4b4c4d4e4f50515253 | DEFGHIJKLMNOPQRS |
| 0x148bd | 5455565758595a000000003230342e31 | TUVWXYZ....204.1 |
| 0x148cd | 302e3139342e36300000000000000100 | 0.194.60........ |
| 0x148dd | 0000004c697374206f66206c6f616465 | ...List of loade |
| 0x148ed | 64206d6f64756c65730a000925702025 | d modules...%p % |
| 0x148fd | 702025702025732025642025730a000a | p %p %s %d %s... |
| 0x1490d | 4d6f64756c657320666f72206170706c | Modules for appl |
| 0x1491d | 69636174696f6e20282570293a0a0009 | ication (%p):... |
| 0x1492d | 25702025730a004d6f64756c65732066 | %p %s..Modules f |
| 0x1493d | 6f722068616e646c652025700a00006d | or handle %p...m |
| 0x1494d | 6d6170206f6620612073706172652070 | map of a spare p |
| 0x1495d | 616765206661696c6564210a0000006f | age failed!....o |
| 0x1496d | 766572666c6f770a000000 | verflow.... |
| 0x14ff4 | 3a20000025732573256d0a0000000000 | : ..%s%s%m...... |
| 0x15004 | 00000000000000000100000000000000 | ................ |
| 0x15014 | 00000000286e696c290000002b002d00 | ....(nil)...+.-. |
| 0x15024 | 2000307800305800101010080a0a0a00 | .0x.0X......... |
| 0x15034 | 686c4c6a7a74715a0002040808000008 | hlLjztqZ........IoT reflection bot with static uClibc tables |
| 0x15044 | 00000108001f0500000f070802000400 | ................ |
| 0x15054 | 01000300001005000000070002000400 | ................ |
| 0x15064 | 010003000001070f1011121315000000 | ................ |
| 0x15074 | 6e7078586f7564696646654567476141 | npxXoudifFeEgGaASSDP/procfs IoT bot with covert C2 markers |
| 0x15084 | 4353637300000000202b302d23274900 | CScs.... +0-#'I. |
| 0x15094 | 08000500030004000100000200000004 | ................ |
| 0x150a4 | 00080200070007080001010104020101 | ................ |
| 0x150b4 | 01010101556e6b6e6f776e206572726f | ....Unknown erro |
| 0x150c4 | 7220000053756363657373004f706572 | r ..Success.Oper |
| 0x150d4 | 6174696f6e206e6f74207065726d6974 | ation not permit |
| 0x150e4 | 746564004e6f20737563682066696c65 | ted.No such file |
| 0x150f4 | 206f72206469726563746f7279004e6f | or directory.No |
| 0x15104 | 20737563 | suc |
Well-known
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
20 of 21 traits shown
Identity
| SHA-256 | 04fc92d37968f2d09f65c6cfd74a39052d504d239c357e5f6612e207b80cfd21 |
|---|---|
| Filename | lkxstress.arm5 |
| Package | 04fc92d37968f2d09f65c6cfd74a39052d504d239c357e5f6612e207b80cfd21 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 3 Aug 2026 22:02 UTC |
|---|---|
| First analyzed | 4 Aug 2026 01:26 UTC |
| Last analyzed | 4 Aug 2026 01:26 UTC |
| Last updated | 4 Aug 2026 01:26 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 95b20 |
Not seeing what you expected? Let us know