MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8
SHA3-384 hash:	444c3b0be08542d091f6737d90228e9cb2da8e6b61abd2bf79cb42c26951f95d95f1365f9ca5bdfa0036113babb723d6
SHA1 hash:	32ed62490eee5d31d80dbd08336185266a17160f
MD5 hash:	9e22cd108d971a864cefc072fc96e9aa
humanhash:	december-black-xray-hamper
File name:	skyljne.mips
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	184'004 bytes
First seen:	2023-12-16 20:12:02 UTC
Last seen:	2023-12-23 17:10:28 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:97UDV7o8pvyK+XLH8wn6xMJgZUBrxR0LRDqt69hE:97UDV7o8pvF+XJ4dZmxW1i69hE
TLSH	T13504B85E6E228F7DF668873047B78E259B5C23D627E1E684D1ACC1141E2039E641FFE8
telfhash	t124419f180e7417e4a3255c59199dff77d6a330ea7e262c338e11e86bab78a439d11c0c
Reporter	elfdigest
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

152

# of downloads :

108

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28886.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28959.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7135898-0

Alert

Create hunting rule

Unix.Trojan.Mirai-8041698-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9945193-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9946826-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9950762-0

Alert

Create hunting rule

Unix.Dropper.Mirai-10008433-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug lolbin masquerade remote

Link:

https://www.filescan.io/uploads/657e0494b4e856b7281c4f59/reports/2f4e622b-3f3f-4329-a258-6ffd744c0268/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

103.178.235.42

Number of open files:

38

Number of processes launched:

3

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

type:Moobot 103.178.235.42:19990

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0025619b-cd2e-44ff-97fd-628f7d24ec63

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1363497

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 17:33:58 UTC

File Type:

ELF32 Big (Exe)

AV detection:

24 of 37 (64.86%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fwetngii7gyxxablia6z4obsks5nkofbahg66lx6atq6shbxnhua._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/231216-yytktsebb3/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/2d89369908f9b17b802b403d9e383254bad538a101cdef2efe04e1e91c3769e8