MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a
SHA3-384 hash: c5ef47a124d03126127c57c003d95e58ecdcab9c736a25e9d4bf10b748b44cb285fa9144b8259e3f81f813a30a4aee4b
SHA1 hash: bc7294ba66083a54163cc00addae1c00f1d82f74
MD5 hash: 8dbbbbf320b6da2a8c257c9f27e425c7
humanhash: jersey-minnesota-victor-blue
File name:8dbbbbf320b6da2a8c257c9f27e425c7
Download: download sample
Signature Mirai
Create hunting rule
File size:28'176 bytes
First seen:2023-03-17 10:33:32 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEMYhymdGUop5hi:ESsoTAZ3alkXLvFh8nNEvs3UozY
TLSH T160C2E13062FE1CB283500672E7785AC9BE534F7DF5F92890114187FB3982D4529EA9C7
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 arm elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-9954191-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug mirai
Link:
https://www.filescan.io/uploads/6414421e28f6cfd59136ab2f/reports/d865b7ac-6b99-42c2-8221-ce8c798bd113/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/85cb7397-af2d-46e2-8141-026acb3474e2
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1195731
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 828635 Sample: r88o3bsRki.elf Startdate: 17/03/2023 Architecture: LINUX Score: 80 42 211.132.174.191 XEPHIONNTT-MECorporationJP Japan 2->42 44 136.27.244.95 WEBPASSUS United States 2->44 46 98 other IPs or domains 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Mirai 2->52 54 2 other signatures 2->54 10 r88o3bsRki.elf 2->10         started        signatures3 process4 process5 12 r88o3bsRki.elf 10->12         started        14 r88o3bsRki.elf 10->14         started        16 r88o3bsRki.elf 10->16         started        process6 18 r88o3bsRki.elf 12->18         started        20 r88o3bsRki.elf 12->20         started        22 r88o3bsRki.elf 14->22         started        24 r88o3bsRki.elf 14->24         started        26 r88o3bsRki.elf 14->26         started        process7 28 r88o3bsRki.elf 18->28         started        30 r88o3bsRki.elf 18->30         started        32 r88o3bsRki.elf 18->32         started        34 r88o3bsRki.elf 22->34         started        36 r88o3bsRki.elf 22->36         started        process8 38 r88o3bsRki.elf 28->38         started        40 r88o3bsRki.elf 28->40         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 10:34:07 UTC
File Type:
ELF32 Little (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddkgjlmxrco65cuywzgwqodbkobu4jwk7wd64walf7eyuotunnna._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/230317-ml4dqahg7v/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2574737/

Comments


Avatar
zbet commented on 2023-03-17 10:33:35 UTC

url : hxxp://185.246.220.166/bins/sora.arm