MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19818befeeaaa5b480afcac840053c892562a52e948c3d6fc27ea25317dd6776. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19818befeeaaa5b480afcac840053c892562a52e948c3d6fc27ea25317dd6776
SHA3-384 hash: 9b400f77ff66f784fc7c1780f5cb625c4c038ac9f7b1179b4528f5be8bfd33ab86778e370c2bec895b889ca704a32ae2
SHA1 hash: f51d425c38135a2b7055cf5954afa5837ef5dccf
MD5 hash: 511762f1b10eab00e1184063857bd215
humanhash: oven-texas-massachusetts-music
File name:511762f1b10eab00e1184063857bd215
Download: download sample
Signature Mirai
Create hunting rule
File size:73'972 bytes
First seen:2021-11-01 03:36:14 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:rHmydbRaeaCTQztHhEI1GnINTYABxbYCU98CiOa:+hEIcIlrYNA
TLSH T144733AD5A8029E7CF49BEAB781230A09B520A3094F930F27F367FCD76CB21549957C86
Reporter zbetcheckin
Tags:32 elf mirai motorola

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai-63.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Exploit-3.UNOFFICIAL
Create hunting rule

Unix.Trojan.Mirai-6981989-0
Create hunting rule

Unix.Dropper.Mirai-7355719-0
Create hunting rule

Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b85b8950-625f-4f70-a335-b0cdfe834b12
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/880128
Signature
Connects to many ports of the same IP (likely port scanning)
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill many processes (SIGKILL)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 512564 Sample: HgTC70XRum Startdate: 01/11/2021 Architecture: LINUX Score: 84 91 157.182.20.49 WVUUS United States 2->91 93 31.191.242.132 WINDTRE-ASIT Italy 2->93 95 98 other IPs or domains 2->95 103 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->103 105 Multi AV Scanner detection for submitted file 2->105 107 Yara detected Mirai 2->107 109 2 other signatures 2->109 10 gdm3 gdm-session-worker 2->10         started        12 gdm3 gdm-session-worker 2->12         started        14 gdm3 gdm-session-worker 2->14         started        16 39 other processes 2->16 signatures3 process4 file5 20 gdm-session-worker gdm-x-session 10->20         started        22 gdm-session-worker gdm-x-session 12->22         started        24 gdm-session-worker gdm-x-session 14->24         started        89 /var/log/wtmp, data 16->89 dropped 97 Reads system files that contain records of logged in users 16->97 26 HgTC70XRum 16->26         started        28 accounts-daemon language-validate 16->28         started        30 accounts-daemon language-validate 16->30         started        32 7 other processes 16->32 signatures6 process7 process8 34 gdm-x-session dbus-daemon 20->34         started        37 gdm-x-session Xorg Xorg.wrap Xorg 20->37         started        39 gdm-x-session dbus-daemon 22->39         started        41 gdm-x-session Xorg Xorg.wrap Xorg 22->41         started        47 2 other processes 24->47 49 8 other processes 26->49 43 language-validate language-options 28->43         started        45 language-validate language-options 30->45         started        51 3 other processes 32->51 signatures9 99 Sample reads /proc/mounts (often used for finding a writable filesystem) 34->99 53 dbus-daemon 34->53         started        55 Xorg sh 37->55         started        57 dbus-daemon 39->57         started        59 Xorg sh 41->59         started        61 language-options sh 43->61         started        63 language-options sh 45->63         started        65 Xorg sh 47->65         started        67 dbus-daemon 47->67         started        101 Sample tries to kill many processes (SIGKILL) 49->101 69 language-options sh 51->69         started        process10 process11 71 dbus-daemon false 53->71         started        73 sh xkbcomp 55->73         started        75 dbus-daemon false 57->75         started        77 sh xkbcomp 59->77         started        83 2 other processes 61->83 85 2 other processes 63->85 79 sh xkbcomp 65->79         started        81 dbus-daemon false 67->81         started        87 2 other processes 69->87
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/19818befeeaaa5b480afcac840053c892562a52e948c3d6fc27ea25317dd6776/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2021-11-01 01:52:05 UTC
AV detection:
23 of 45 (51.11%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211101-d6gwsadgcn/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/19818befeeaaa5b480afcac840053c892562a52e948c3d6fc27ea25317dd6776

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 19818befeeaaa5b480afcac840053c892562a52e948c3d6fc27ea25317dd6776

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1734497/

Comments


Avatar
zbet commented on 2021-11-01 03:36:15 UTC

url : hxxp://23.94.37.59/bins/Tsunami.m68k