MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf
SHA3-384 hash: d59fe7663f17908318294bff24f77a6bf0469edcf6e6fe092cbad44a1e9cadc7d66a1cc1054f5fce27222b386dad5992
SHA1 hash: cbf7fa4d082a62be9a1e2dfb03be80bab479c869
MD5 hash: 0d6189f4e61001f513d4e09331cbac30
humanhash: triple-kansas-virginia-fourteen
File name:mips
Download: download sample
Signature Mirai
Create hunting rule
File size:89'096 bytes
First seen:2024-12-24 08:31:17 UTC
Last seen:2024-12-26 07:46:35 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:8xEhzWUfj1yZtM2AnGBbGBX9BqU8fjTZQMOntojeWD2tPxf55:8Cic6tMb2HWMOtoY1xfn
TLSH T18C93C85E6E718FBDF66C833447B74E21A75923D627E0C685E2ACD2101E2038E585FFA4
telfhash t1f9212c484d7823e497755dd81aedff77e59130de0a226e378e10a9adaaad9029e00c1c
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9999.358.16742.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=676a718375bf3268d2fe3079linux22vpnfull_triage
Tags:
malware
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug lolbin remote
Link:
https://www.filescan.io/uploads/676a7187bda68b1c3528da42/reports/7a532702-d16f-465f-b57d-7298f245faf5/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e82cf372-a42a-4489-8fe9-04e675521816
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1580325
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-12-24 08:32:04 UTC
File Type:
ELF32 Big (Exe)
AV detection:
6 of 38 (15.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b32wsax6j73dms27izg5dcpy2btdeieunv6c4lz7bhc7vncwnhhq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/241224-ke97kstjgt/
Behaviour
System Network Configuration Discovery
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/04b36725-1d50-4862-afd0-9c5cc86902d7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_Mirai
Create hunting rule
Author:NDA0E
Description:Detects multiple Mirai variants
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 3851eee22e73e59e60d2d0e5bb46227538a26e24f4fc47312543f0a755c875a6

Mirai

elf 0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3372335/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3375244/
  
Dropped by
SHA256 3851eee22e73e59e60d2d0e5bb46227538a26e24f4fc47312543f0a755c875a6
  
Dropped by
MD5 c8d547e66f4a643aaeae42c6c9e8f1b0
  
Dropped by
SHA256 db70c1322d1da3f0fc2bc0f5c26b80977e4144a7dd79f24b95fb23740e345962
  
Dropped by
MD5 e961c29f47ebdd118ef86e50160100b7
  
Dropped by
SHA256 87e93ec6203e24ba46835c440a865f41cf24d77769ca9adf17cd38e06a149c00
  
Dropped by
MD5 96fdba9d2cd1e100adfbf839d9c301db
  
Dropped by
SHA256 f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58
  
Dropped by
MD5 c24137535d17c8be48f5f74a45634ab0
  
Dropped by
SHA256 62b778a53df56fc7cf98ae512eae0a519285f3270da01618adeabdd8e7af6992
  
Dropped by
MD5 4fbacccb18e7e0d0998484a370dbddf1
  
Dropped by
SHA256 a2e42d299a0c5085ea3d162ec0b0696accf5f08b935773bf75c383bd552fa6cf
  
Dropped by
MD5 b82b978ea5e5f7b8c64c8e4b49000555
  
Dropped by
SHA256 efaeb6776bc2ba6161a32e3a387c6876ad8c7dd8ab74cd117af2b9b9ea0e8bd0
  
Dropped by
MD5 8807aeb90c4c3cb0a0d353ea635c6697

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments