MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42
SHA3-384 hash: edcb88f24710774099cd1875b252852fdb0e1b4feccaf9fe6808f7492443e24676d259fab8473fc465c2f70f6f50e21e
SHA1 hash: 85ba945fef9f555aa192c8ce8eb3026a5916ca53
MD5 hash: d541d7fb2a9e83b64df6f6741cb18b9e
humanhash: robin-quebec-apart-echo
File name:irc.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:28'128 bytes
First seen:2022-06-15 04:51:05 UTC
Last seen:2022-06-15 05:39:57 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:qXnetKSLaxMB1JfokBwEAGmqe6I8Us3UozD:guKSL1B1Jfo+HA2e6I8xzD
TLSH T17BC2E2709B210663DA70093BE86983433B6762B4A1E7BD711C3481BC14C66895EF5FFD
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter tolisec
Tags:mirai

Intelligence

File Origin
# of uploads :
4
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.9999.17070.30837.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/62a9658d96efd87b05fa0cff/reports/82019607-b8a2-4feb-9d7f-ad1513efdb85/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
62.197.136.92/shitnet
Number of open files:
53
Number of processes launched:
6
Processes remaning?
false
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42
Behaviour
Information Gathering
Botnet C2s
TCP botnet C2(s):
62.197.136.92:9506
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4e73e887-dfca-4076-bb39-db54721734bb
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1013406
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 645911 Sample: irc.arm Startdate: 15/06/2022 Architecture: LINUX Score: 52 28 Multi AV Scanner detection for submitted file 2->28 30 Sample is packed with UPX 2->30 8 irc.arm 2->8         started        process3 process4 10 irc.arm 8->10         started        12 irc.arm 8->12         started        14 irc.arm 8->14         started        process5 16 irc.arm 10->16         started        18 irc.arm 10->18         started        20 irc.arm 10->20         started        22 2 other processes 10->22 process6 24 irc.arm 16->24         started        26 irc.arm 18->26         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-06-15 04:52:05 UTC
File Type:
ELF32 Little (Exe)
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fz4qohlo3nqcg2qvj2vyrwu64nv4f74q3zxsmv2qmyzpeejqvrba._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220615-fhdkkahhd8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.23
Link:
https://yomi.yoroi.company/submissions/2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 2e79071d6edb60236a154eab88da9ee36bc2ff90de6f2657506632f21130ac42

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2238483/
  
Delivery method
Distributed via web download

Comments