AI
Mirai botnet binary detected
Local reference
Suspicious dependency
Inferred
Mal-ecule
K(Mc₂)H₃(F₃Po₂Cm₂)Md₃(Bi₂BkHe)
Mirai SORA credential brute force with VSE flood: David.ppc:0xb1e4
Mirai SORA credential brute force: David.ppc:0xb1e4
Hakai BusyBox path XOR string: David.ppc:0xb200
| 0x0 | 7f454c46010201000000000000000000 | .ELF............ |
| 0x10 | 0002001400000001100001f000000034 | ...............4 |
| 0x20 | 0000bae0000000000034002000030028 | .........4. ...( |
| 0x30 | 000c000b000000010000000010000000 | ................ |
| 0x40 | 100000000000b8600000b86000000005 | .......`...`.... |
| 0x50 | 00010000000000010000b8641001b864 | ...........d...d |
| 0x60 | 1001b864000002300000054400000006 | ...d...0...D.... |
| 0x70 | 000100006474e5510000000000000000 | ....dt.Q........ |
| 0x80 | 00000000000000000000000000000006 | ................ |
| 0x90 | 000000049421ffe07c0802a690010024 | .....!..|......$ |
| 0xa0 | 480000c948009a2d8001002438210020 | H...H..-...$8!. |
| 0xb0 | 7c0803a64e8000209421fff07c0802a6 | |...N.. .!..|... |
| 0xc0 | 93c100083fc0100290010014881ebafc | ....?........... |
| 0xd0 | 93e1000c2f800000409e005c3fe01002 | ..../...@..\?... |
| 0xe0 | 817fb87c812b00002f890000419e0024 | ...|.+../...A..$ |
| 0xf0 | 380b00047d2903a6901fb87c4e800421 | 8...}).....|N..! |
| 0x100 | 817fb87c812b00002f890000409effe4 | ...|.+../...@... |
| 0x110 | 3d200000392900002f890000419e0010 | = ..9)../...A... |
| 0x120 | 3c6010013863b8604bfffed938000001 | <`..8c.`K...8... |
| 0x130 | 981ebafc8001001483c1000883 | ............. |
| 0x7974 | 9421ffe07c0802a69061000838600002 | .!..|....a..8`.. |
| 0x7984 | 9081000c388100089001002490a10010 | ....8......$.... |
| 0x7994 | 4800163d80010024382100207c0803a6 | H..=...$8!. |... |
| 0x79a4 | 4e8000209421ffe07c0802a690610008 | N.. .!..|....a.. |
| 0x79b4 | 386000039081000c3881000890010024 | 8`......8......$ |
| 0x79c4 | 90a10010480016098001002438210020 | ....H......$8!. |
| 0x79d4 | 7c0803a64e8000209421ffe07c0802a6 | |...N.. .!..|... |
| 0x79e4 | 90610008386000069081000c38810008 | .a..8`......8... |
| 0x79f4 | 9001002490a10010480015d580010024 | ...$....H......$ |
| 0x7a04 | 382100207c0803a64e8000209421ffd0 | 8!. |...N.. .!.. |
| 0x7a14 | 7c0802a6906100083860000f9081000c | |....a..8`...... |
| 0x7a24 | 388100089001003490a1001090c10014 | 8......4........ |
| 0x7a34 | 90e1001848001599800100 | ....H...... |
| 0x7a48 | 4e8000209421ffe07c0802a690610008 | N.. .!..|....a.. |
| 0x7a58 | 386000049081000c3881000890010024 | 8`......8......$ |
| 0x7a68 | 4800156980010024382100207c0803a6 | H..i...$8!. |... |
| 0x7a78 | 4e8000209421ffe07c0802a690610008 | N.. .!..|....a.. |
| 0x7a88 | 3860000a9081000c3881000890010024 | 8`......8......$ |
| 0x7a98 | 90a1001090c100144800153180010024 | ........H..1...$ |
| 0x7aa8 | 382100207c0803a64e8000209421ffd0 | 8!. |...N.. .!.. |
| 0x7ab8 | 7c0802a6906100083860000c9081000c | |....a..8`...... |
| 0x7ac8 | 388100089001003490a1001090c10014 | 8......4........ |
| 0x7ad8 | 90e100189101001c480014f180010034 | ........H......4 |
| 0x7ae8 | 382100307c0803a64e8000209421ffe0 | 8!.0|...N.. .!.. |
| 0x7af8 | 7c0802a690610008386000099081000c | |....a..8`...... |
| 0x7b08 | 388100089001002490a100 | 8......$... |
| 0xb164 | 000000001b2c3c382307136c00000000 | .....,<8#..l.... |
| 0xb174 | 07663213251a1227000000000d0a0000 | .f2.%..'........ |
| 0xb184 | 263b3b2000000000ffff9f80ffff9f80 | &;; ............ |
| 0xb194 | ffffa064ffffa144ffffa2a4ffffa3a4 | ...d...D........ |
| 0xb1a4 | ffffa48cffffa65cffffa82cffffa574 | .......\...,...t |
| 0xb1b4 | ffffa744fffa1f00500018fff0000000 | ...D....P....... |
| 0xb1c4 | fffb1f00729f0000f1e100001e110374 | ....r..........t |
| 0xb1d4 | 233527743c31263174383b3854000000 | #5't<1&1t8;8T... |
| 0xb1e4 | 273c313838540000313a353638315400 | '<188T..1:5681T.Mirai SORA credential brute force |
| 0xb1f4 | 272d272031395400273c54007b363d3a | '-' 19T.'<T.{6=:Hakai BusyBox path XOR string |
| 0xb204 | 7b3621272d363b2c741f010617540000 | {6!'-6;,t....T.. |
| 0xb214 | 1f0106176e74352424383120743a3b20 | ....nt5$$81 t:; |
| 0xb224 | 74323b213a3054003a373b2626313720 | t2;!:0T.:7;&&17 Mirai SORA credential brute force with VSE flood |
| 0xb234 | 540000007b363d3a7b3621272d363b2c | T...{6=:{6!'-6;, |
| 0xb244 | 74242754000000007b363d3a7b362127 | t$'T....{6=:{6!' |
| 0xb254 | 2d363b2c743f3d383874796d74540000 | -6;,t?=88tymtT.. |
| 0xb264 | 7b24263b377b3a31207b263b21203154 | {$&;7{:1 {&;! 1TMirai SORA network config access |
| 0xb274 | 000000007b24263b377b54007b312c31 | ....{$&;7{T.{1,1 |
| 0xb284 | 540000007b323054000000007b24263b | T...{20T....{$&; |
| 0xb294 | 377b3a31207b2037245400007b312037 | 7{:1 { 7$T..{1 7 |
| 0xb2a4 | 7b2631273b38227a373b3a3254000000 | {&1';8"z7;:2T... |
| 0xb2b4 | 3a353931273126223126745400000000 | :591'1&"1&tT.... |
| 0xb2c4 | 193534343f392e333534607a313f3f2a | .544?9.354`z1??* |
| 0xb2d4 | 773b36332c3f5a001b39393f2a2e607a | w;63,?Z..99?*.`z |
| 0xb2e4 | 2e3f222e75322e3736763b2a2a363339 | .?".u2.76v;**639 |
| 0xb2f4 | 3b2e3335347522322e37367122373676 | ;.354u"2.76q"76v |
| 0xb304 | 3b2a2a3633393b2e3335347522373661 | ;**639;.354u"76a |
| 0xb314 | 2b676a74637633373b3d3f752d3f382a | +gjtcv37;=?u-?8* |
| 0xb324 | 76707570612b676a74625a001b39393f | vpupa+gjtbZ..99? |
| 0xb334 | 2a2e77163b343d2f3b3d3f607a3f3477 | *.w.;4=/;=?`z?4w |
| 0xb344 | 0f09763f34612b676a74625a00000000 | ..v?4a+gjtbZ.... |
| 0xb354 | 1935342e3f342e770e232a3f607a3b2a | .54.?4.w.#*?`z;* |
| 0xb364 | 2a3633393b2e3335347522772d2d2d77 | *639;.354u"w---w |
| 0xb374 | 3c352837772f28363f3439353e3f3e5a | <5(7w/(6?495>?>Z |
| 0xb384 | 00000000293f2e19353531333f727d5a | ....)?..5513?r}Z |
| 0xb394 | 00000000283f3c283f2932605a000000 | ....(?<(?)2`Z... |
| 0xb3a4 | 3635393b2e333534605a0000293f2e77 | 659;.354`Z..)?.w |
| 0xb3b4 | 3935 | 95 |
| 0xb3d4 | 2e283b34293c3f28773f3439353e3334 | .(;4)<?(w?495>34 |
| 0xb3e4 | 3d605a0039322f34313f3e5a00000000 | =`Z.92/41?>Z.... |
| 0xb3f4 | 393534343f392e333534605a00000000 | 9544?9.354`Z.... |
| 0xb404 | 293f282c3f28607a3e35293b28283f29 | )?(,?(`z>5);((?) |
| 0xb414 | 2e5a0000293f282c3f28607a3936352f | .Z..)?(,?(`z965/ |
| 0xb424 | 3e3c363b283f77343d3334225a000000 | ><6;(?w4=34"Z... |
| 0xb434 | 7b3031227b233520373c303b33540000 | {01"{#5 7<0;3T.. |
| 0xb444 | 7b3031227b393d27377b233520373c30 | {01"{9='7{#5 7<0 |
| 0xb454 | 3b3354007b27363d3a7b233520373c30 | ;3T.{'6=:{#5 7<0 |
| 0xb464 | 3b3354007b363d3a7b233520373c303b | ;3T.{6=:{#5 7<0; |
| 0xb474 | 335400007b3031227b233520373c303b | 3T..{01"{#5 7<0; |
| 0xb484 | 336454007b3120377b30313235213820 | 3dT.{1 7{0125!8 |
| 0xb494 | 7b233520373c303b335400007b312037 | {#5 7<0;3T..{1 7 |
| 0xb4a4 | 7b233520373c303b3354000035272723 | {#5 7<0;3T..5''#Mirai SORA credential brute force |
| 0xb4b4 | 3b263054000000003b333d3a54000000 | ;&0T....;3=:T...Mirai SORA credential brute force with VSE flood |
| 0xb4c4 | 313a203126540000653336356037303b | 1: 1&T..e365`70; |
| 0xb4d4 | 3961673a3c246566313d643f323e5400 | 9ag:<$ef1=d?2>T. |
| 0xb4e4 | 00073b2126373174113a333d3a317405 | ..;!&71t.:3=:1t.Mirai VSE flood query string |
| 0xb4f4 | 2131262d540000007b3031227b120003 | !1&-T...{01"{... |
| 0xb504 | 10006564650b233520373c303b335400 | ..ede.#5 7<0;3T. |
| 0xb514 | 7b3031227b12000310006564657b2335 | {01"{.....ede{#5 |
| 0xb524 | 20373c303b3354000000000000000003 | 7<0;3T......... |
| 0xb534 | 00000001000000030000000100000000 | ................ |
| 0xb544 | 000000070000000f0000001f0000003f | ...............? |
| 0xb554 | 2f6465762f6e756c6c00000000000000 | /dev/null....... |
| 0xb564 | 00000000000000000000000000000000 | ................ |
| 0xb574 | 00000000000000000000000000000000 | ................ |
| 0xb584 | 00000000000000000000000000000000 | ................ |
| 0xb594 | 00000000000000000000000000000000 | ................ |
| 0xb5a4 | 00000000000000000000000000000000 | ................ |
| 0xb5b4 | 00000000000000000000000000000000 | ................ |
| 0xb5c4 | 00000000000000000000000000000000 | ................ |
| 0xb5d4 | 00000000000000000000000000000000 | ................ |
| 0xb5e4 | 00000000000000000000000000000000 | ................ |
| 0xb5f4 | 00000000000000000000000000000000 | ................ |
| 0xb604 | 00000000000000000000000000000000 | ................ |
| 0xb614 | 000000000000000000000000 | ............ |
Well-known
Micro-behaviors
Metadata
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
Identity
| SHA-256 | 6908f9762a9d3a6a17059b124a58cf1928e1fb12a9d89816eb8fcdfd9c556d1c |
|---|---|
| Filename | David.ppc |
| Package | 6908f9762a9d3a6a17059b124a58cf1928e1fb12a9d89816eb8fcdfd9c556d1c |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 8 Aug 2026 09:46 UTC |
|---|---|
| First analyzed | 10 Aug 2026 08:00 UTC |
| Last analyzed | 10 Aug 2026 08:00 UTC |
| Last updated | 10 Aug 2026 08:00 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 46d16 |
Not seeing what you expected? Let us know