MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments 1

SHA256 hash:	25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9
SHA3-384 hash:	7190f8564d9c8566f6abbcf9457c2c7e89641d663330a38126efeea096b24eedf0a15930e955e61a3befdcbe8f702832
SHA1 hash:	439118160254c013e039e546ffb900a703459e61
MD5 hash:	792b063231f223d067abe9e0333818e5
humanhash:	ten-fourteen-kilo-london
File name:	792b063231f223d067abe9e0333818e5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	67'060 bytes
First seen:	2024-04-18 11:19:34 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:/mKtW4jikM0ApdWVjdoAeaY+zhX6GOly2:/jtDM0ANbZ+YGOlV
TLSH	T13B634A25B5352A1BC4D8693A25F79329F1F91B4A34FCCB1B7D320E8DBB24610661B2F4
Reporter	zbetcheckin
Tags:	32 elf mirai sparc

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e597ce62-243e-44ef-97ef-2f9425c22606

Result

Threat name:

Mirai

Detection:

malicious

Classification:

spre.troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1428050

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-04-17 21:55:30 UTC

File Type:

ELF32 Big (Exe)

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ex42mju37mx4sgbq2zkjb7pjmnblpu5uu37e55i5k4ggzhsbmduq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/240418-nfec3sbd84/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research