MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345
SHA3-384 hash:	4160eb722daf0ed989d6f415e1f6a88ae7e6afad6a20fc26151776f0067f88eb03eef7408504e253b18f2307579af4aa
SHA1 hash:	14c6d9231087b174c621570e674bed0a7a681633
MD5 hash:	df8ac01308ab6015e8ab997165338246
humanhash:	quebec-neptune-stairway-north
File name:	zerarm
Download:	download sample
Signature	Mirai Create hunting rule
File size:	48'168 bytes
First seen:	2024-10-27 07:57:19 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:vic2x0lAcmc4mkM50az5xehsXdT6tQ0tHloK5kcIRBXNq5fvqU1Q6wn:aDxGAdazKhsXdetQ0tdkVBUSn
TLSH	T175232881B8819A17C5E4137FF62F428D372523A8E2DF7217DD226F057B8A92F0DA7641
telfhash	t1ed31bb35ded80a8c9be0c189411f463f4a9a34b85742210d8f2d6f9f46a3e917665877
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Gafgyt-9940653-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671e4354a75e41aa672259eblinux22vpnfull_triage

Tags:

mirai

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

android anti-debug mirai

Link:

https://www.filescan.io/uploads/671df29c7b6de3d3d355cf37/reports/2e70ff9d-1232-41e2-9086-960b4d410abc/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1fdc453d-c66d-4464-8d21-2347ce1bebb7

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1543153

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-10-26 23:22:00 UTC

File Type:

ELF32 Little (Exe)

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dxllshs4ag2tdlg2bfogml3esy4odib6yfascniewemtqnhisncq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/241027-jtw3tstkbr/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b4ede3fe-1bb6-4440-9ded-f5a8a0aa50e5

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.