MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb
SHA3-384 hash:	f94cdf31f75dd280d73a0c251aefb2661ea9063cfcaf556d49916da5b41cdf9fc31e256bfbd8ea4ff19e2d6fb0b97cc0
SHA1 hash:	df3e6f27f11d1dcc523c20fb93afd156d35b5412
MD5 hash:	97578af6cca95e3dd3cc58af4f9332fb
humanhash:	sierra-nine-magazine-may
File name:	armv5l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	86'004 bytes
First seen:	2025-01-23 01:10:47 UTC
Last seen:	2025-01-23 07:25:42 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:jTifvcAhaXVcydy0q9xQhY0pZN9fWZntiw9Uig2Lq+/0z3RkC94mVkZp:3IFhaldy0oxQhPFZw2J2Lqf3l6Z
TLSH	T13E835A857D818522C9D1337BFA1E528C336567E8E2EE72178C221F55BBDAC2B0D7B205
telfhash	t1edc01279da1071c80f890a1690ae220506ddf19d1b04b8a555a666c10583461753dd09
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

131

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67919b06e708b6e7a3affc82linux22vpnfull_triage

Tags:

mirai

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

9000,8888,81,6700,8081,80,8001,8000,8010,34567,88,67,9999,3128,8080,50100,23,90,79,8090,5000,85,82,8181,70,83,84,34568,9001,2051

Full report:

https://elfdigest.com/brief/19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb

Behaviour

Anti-VM

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

type: 172.217.192.127:3478

Result

Verdict:

UNKNOWN

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/2819b8e7-7117-42ce-a308-e7039146d1fe

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1597214

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Performs DNS TXT record lookups

Sample deletes itself

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2025-01-23 01:11:03 UTC

File Type:

ELF32 Little (Exe)

AV detection:

7 of 38 (18.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dhzlckqa5h52poo56cfwhajaiys5fyo5tga7cxlwhrdlab33ttnq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/250123-bjxmlswjhk/

Behaviour

Enumerates kernel/hardware configuration

Changes its process name

Reads system network configuration

Reads MAC address of network interface

Reads network interface configuration

Deletes itself

Unexpected DNS network traffic destination

Contacts a large (891776) amount of remote hosts

Creates a large amount of network flows

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/91857a3e-e89e-45dd-b969-7882ee76f687

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.