MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a78112a574a92d8eed76b361ed09acffa81d08ffaf55669ea4d6854bf6df59b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	2a78112a574a92d8eed76b361ed09acffa81d08ffaf55669ea4d6854bf6df59b
SHA3-384 hash:	a35b152c7c7cf9799982028bb990398cacb338f2d641d0cde37e5db6bbda578e708faaac97c9a298f98d530a8f6eac7c
SHA1 hash:	3f0b60928f9c5bc1ab9ce21bbabd762ca2df5923
MD5 hash:	0aff0067e7ffb1f7808ca0473b873f71
humanhash:	emma-zulu-berlin-coffee
File name:	bot.arm6-20240307-2338
Download:	download sample
Signature	Mirai Create hunting rule
File size:	143'292 bytes
First seen:	2024-03-07 23:38:07 UTC
Last seen:	2024-03-09 19:31:47 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:ZUIK7WIUPMNrbAXx0Wfw4a+15ejwDCO3CZRpz:ZUrRUuAX2Wfxa0rH3CZRt
TLSH	T112E30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905
telfhash	t12701f193cf952ddcc3d081b4c15db21b46da71ea22886c4b9495579f09125a3b13dc30
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	elfdigest
Tags:	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

382

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash lolbin mirai remote

Link:

https://www.filescan.io/uploads/65ea501d87137159d43569ef/reports/13cced08-3416-407d-ac10-b1f1a9420811/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f93e00a0-ea99-4226-a038-5653ec339570

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1405170

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2a78112a574a92d8eed76b361ed09acffa81d08ffaf55669ea4d6854bf6df59b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2a78112a574a92d8eed76b361ed09acffa81d08ffaf55669ea4d6854bf6df59b/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-03-07 22:58:37 UTC

File Type:

ELF32 Little (Exe)

AV detection:

25 of 37 (67.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fj4bcksxjkjnr3wxnm3b5ue2z75iduep7l2vm2pkjvufjp3n6wnq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/240307-3m9vwsac91/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/2a78112a574a92d8eed76b361ed09acffa81d08ffaf55669ea4d6854bf6df59b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.