MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48
SHA3-384 hash: 5a1071f780430f4d2784c25cec1387c86a91705d78b438707c5f3bfdbb7f5ded900f18fcb433127d84b999293d6095af
SHA1 hash: 8ce53713f6d3bff332679fc01cadb193cb21c89f
MD5 hash: 75efc49a4de86a195a6e9118a8624b5c
humanhash: five-idaho-sixteen-washington
File name:75efc49a4de86a195a6e9118a8624b5c
Download: download sample
Signature Mirai
Create hunting rule
File size:25'004 bytes
First seen:2023-09-29 19:30:45 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p62hymdGUop5hr:QX9nxn8o9wnBoWzEQf2EjKb3p9s3UozJ
TLSH T1F0B2D0B17014F8B2C7A200B75AEDDB83FA800EF8D0E873295469099DEAD5D43BAF1547
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 arm elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-7853646-0
Create hunting rule

Unix.Dropper.Mirai-8011185-0
Create hunting rule

Unix.Trojan.Mirai-8274771-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug packed upx
Link:
https://www.filescan.io/uploads/651725fd33582f234e075b97/reports/2b027563-164d-4265-a44a-c7b3fe30175f/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbda6e5e-1027-4e34-958c-12acb9736684
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1316858
Signature
Detected Mirai
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1316858 Sample: xvQ9UwIcmO.elf Startdate: 29/09/2023 Architecture: LINUX Score: 76 24 149.219.20.209, 23 WDR-ASDE Germany 2->24 26 31.26.4.198 VODAFONE-IT-ASNIT Italy 2->26 28 98 other IPs or domains 2->28 32 Snort IDS alert for network traffic 2->32 34 Detected Mirai 2->34 36 Yara detected Mirai 2->36 38 2 other signatures 2->38 8 xvQ9UwIcmO.elf 2->8         started        signatures3 process4 process5 10 xvQ9UwIcmO.elf 8->10         started        12 xvQ9UwIcmO.elf 8->12         started        15 xvQ9UwIcmO.elf 8->15         started        signatures6 17 xvQ9UwIcmO.elf 10->17         started        20 xvQ9UwIcmO.elf 10->20         started        22 xvQ9UwIcmO.elf 10->22         started        40 Sample tries to kill multiple processes (SIGKILL) 12->40 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-09-29 20:16:09 UTC
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ad6pzcxdw36gi6n3efgt6nwobaikkolxf2yg7q2ipn5iynyul5ea._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/230929-x8c56afe56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2715151/

Comments


Avatar
zbet commented on 2023-09-29 19:30:46 UTC

url : hxxp://141.98.10.40/bins/phantom.arm