MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 12

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07
SHA3-384 hash:	6ba574496f68bd387d4c1cd1d94d9d9de5dccc8db54343a0e8548fb98e2f0f11dd35590510e6223bf24f8ccec81c8c5c
SHA1 hash:	cdc58cdab08c05e592f0dcc231db7e54aa141753
MD5 hash:	6b070f94b644316ea982ea71b8f22486
humanhash:	pluto-west-oven-venus
File name:	firmware.armv7l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	136'420 bytes
First seen:	2024-09-01 15:29:09 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:I60j1PPFurocpgwS2GWddcaz9nkBZla1KfBZcqVgqWImte:Ihj1X4TGWbcaz9nkBZ04fDV9W9te
TLSH	T1B6D31B46A942DF11D5C722BAFB9E418C33136BB8D3EA3102DD245F6133CA99B0EB7552
telfhash	t114216266ee580e8c17d54e4d91ef652eadfe30ea670024114f1c5b4f45a38c3702983b
Magika	elf
Reporter	NDA0E
Tags:	elf firmware mirai

Intelligence

File Origin

# of uploads :

# of downloads :

117

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sends data to a server

Deleting a recently created file

DNS request

Connection attempt

Receives data from a server

Creating a file

Kills processes

Runs as daemon

Changes the time when the file was created, accessed, or modified

Creating a file in the %temp% directory

Sets a written file as executable

Launching a process

Changes access rights for a written file

Substitutes an application name

Writes files to system directory

Creates or modifies files in /cron to set up autorun

Performs a bruteforce attack in the network

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug botnet gcc lolbin mirai remote

Link:

https://www.filescan.io/uploads/66d4887e4d7501a56ad1d5c7/reports/3cb872f0-5063-4431-85b7-962a89b2d220/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a6163720-75f2-43be-bbd0-890914b98553

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-09-01 03:26:02 UTC

File Type:

ELF32 Little (Exe)

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=drdlpcgneect24ypl2s4dbww4tzdvjrlv4yhaa7qzvzzsfhezmdq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet discovery persistence

Link:

https://tria.ge/reports/240901-sxga8avcmk/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Creates/modifies Cron job

Writes file to system bin folder

Unexpected DNS network traffic destination

Contacts a large (47263) amount of remote hosts

Creates a large amount of network flows

Mirai

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c46b788cd21053d730f5ea5c186d6e4f23aa62baf307003f0cd739914e4cb07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Generic_Threat_8299c877 Create hunting rule
Author:	Elastic Security

Rule name:	Mirai_Botnet_Malware Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	Mirai_Botnet_Malware_RID2EF6 Create hunting rule
Author:	Florian Roth
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research