MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72
SHA3-384 hash:	f834daaa42e610382d922512baf15d190cd5a8bcd1fb7a434c5014af835b02ddb8142b202350742a5f88c68287d3f5b4
SHA1 hash:	18da299567e208c22e0ccb1762329be56a5e76f4
MD5 hash:	6f23c3eeeca6d146dc8ee5e8ad14cba8
humanhash:	comet-uniform-high-stairway
File name:	skyljne.x86_64
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	151'864 bytes
First seen:	2023-12-16 20:11:58 UTC
Last seen:	2023-12-23 17:10:24 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:/eqQbEpOqam4DgDrDP+uuaHs+aog/wAdkJHtnc6TbOnD+SBm:/eqQb6Oqams0Yzk/uD+W
TLSH	T122E33A17B5C18CFDC4DAC2B44B9AF53ADD32F0A91238B16B27D4AB221E4DE205F1DA44
telfhash	t14051fe703a65389472f7f676b30ae8e5ac310e2425e038d1d977bdf48ea67c80d76462
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	elfdigest
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

153

# of downloads :

111

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28959.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7135898-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7540662-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9945193-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9946826-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9950762-0

Alert

Create hunting rule

Unix.Dropper.Mirai-10008433-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug lolbin mirai remote

Link:

https://www.filescan.io/uploads/657e0493314dbc3b9b589d35/reports/6a446c71-45d2-49cc-9796-24863570efa9/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

103.178.235.42

Number of open files:

47

Number of processes launched:

3

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

type:Moobot 103.178.235.42:19990

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/14be68bb-ef56-4d0d-b258-328459e9e392

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1363498

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 17:30:13 UTC

File Type:

ELF64 Little (Exe)

AV detection:

24 of 37 (64.86%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=elijwqbqfqmqprrtmp6irdbfvs37rmv2pqkecm5l2qfn4gfmxzza._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

linux

Link:

https://tria.ge/reports/231216-yytktscgdq/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/22d09b40302c1907c63363fc888c25acb7f8b2ba7c144133abd40ade18acbe72