MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07cd266d7803dbdbd22cdc9db4e191feb4f8a5b41a00628871f11671d120d242. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07cd266d7803dbdbd22cdc9db4e191feb4f8a5b41a00628871f11671d120d242
SHA3-384 hash: 659f5413619f6e2f2f73ffde0129542b631526e7d65d0c28552ff246f42ee4719257b47ebacacd446e2945ef88ce0f13
SHA1 hash: f85190c95bf3c467a9ab84e97ee29bf2c2555154
MD5 hash: 0c8bd50390acc6ed4aeebaac35b5cc4f
humanhash: wyoming-maryland-pasta-massachusetts
File name:0c8bd50390acc6ed4aeebaac35b5cc4f
Download: download sample
Signature Mirai
Create hunting rule
File size:52'476 bytes
First seen:2022-04-07 23:41:04 UTC
Last seen:2022-04-08 00:32:47 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:QiEGdTzJFFj9/GSYhC102M6fN1DEItxrM:f1rJYks2DE8rM
TLSH T115333A25693A1E1BC4D0A87E21F347A4B3F16A5E2AE8C94E7D730D4EFF21A4054176F8
Reporter zbetcheckin
Tags:32 elf mirai sparc

Intelligence

File Origin
# of uploads :
2
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai.632.12337.21346.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug gafgyt mirai
Link:
https://www.filescan.io/uploads/624f76cdcccdcb99472718ae/reports/fbc0feec-54eb-45ea-b27b-3a1cf669d40c/overview
Result
Verdict:
UNKNOWN
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/22575c55-c6ab-4a11-85f1-9c2e2672d1f4
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/972774
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 605261 Sample: owCSUiyizY Startdate: 08/04/2022 Architecture: LINUX Score: 48 43 192.210.132.120, 3884, 41440 SERVER-MANIACA United States 2->43 45 109.202.202.202, 80 INIT7CH Switzerland 2->45 47 2 other IPs or domains 2->47 49 Multi AV Scanner detection for submitted file 2->49 9 systemd logrotate 2->9         started        11 systemd mandb owCSUiyizY 2->11         started        13 systemd install 2->13         started        15 systemd find 2->15         started        signatures3 process4 process5 17 logrotate sh 9->17         started        19 logrotate sh 9->19         started        21 logrotate gzip 9->21         started        23 logrotate gzip 9->23         started        25 owCSUiyizY 11->25         started        27 owCSUiyizY 11->27         started        process6 29 sh invoke-rc.d 17->29         started        31 sh rsyslog-rotate 19->31         started        process7 33 invoke-rc.d runlevel 29->33         started        35 invoke-rc.d systemctl 29->35         started        37 invoke-rc.d ls 29->37         started        39 invoke-rc.d systemctl 29->39         started        41 rsyslog-rotate systemctl 31->41         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/07cd266d7803dbdbd22cdc9db4e191feb4f8a5b41a00628871f11671d120d242/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-04-07 23:42:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai linux
Link:
https://tria.ge/reports/220407-3pzspsbaan/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/07cd266d7803dbdbd22cdc9db4e191feb4f8a5b41a00628871f11671d120d242

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 07cd266d7803dbdbd22cdc9db4e191feb4f8a5b41a00628871f11671d120d242

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2136394/

Comments


Avatar
zbet commented on 2022-04-07 23:41:11 UTC

url : hxxp://192.210.132.120/bins/vcimanagement.spc