MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c
SHA3-384 hash:	5945f9d03d57a7f9854dbbb1dd583fb486721d0eb9eb5ed63b995ffd993ea7a3385a7fe3eaa0cc02b889ea51e874e262
SHA1 hash:	d133d027e23c09dbf3e8c5c8f32fea7becd93a3b
MD5 hash:	9bf90a89138a9fb7f3e05d732366b081
humanhash:	mexico-tennessee-ceiling-steak
File name:	miori.arm
Download:	download sample
Signature	Mirai Create hunting rule
File size:	37'856 bytes
First seen:	2025-01-07 19:41:22 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:y1flYOks2UEv19b2J5X1xDjicQmUaSU8GBcsNVIN8yMxE8JCVmR:WNYfsHEvanDVUbU8HsoOxnZ
TLSH	T14203D588B992D907C6D4537BFE4E42CD37262398F2DE3203DE151F91379A92A0EAB151
telfhash	t147c02b79045601e0b7d142c2411d1a1002a8f008cc6f0d5037f22e9e5713a738813824
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9999.10257.9284.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677d8445ffdcee13ec8649b2linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-debug masquerade

Link:

https://www.filescan.io/uploads/677d838a93047f3a9110d239/reports/00956108-ab5d-42ab-91e2-2b985229a2fc/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

2323,23

Full report:

https://elfdigest.com/brief/368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

type:Mirai 79.124.60.186:3277

UDP botnet C2(s):

not identified

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/57f14986-f202-4d4d-a907-89f89406606c

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1585565

Signature

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2025-01-07 19:42:04 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g2gzzhjahxe6mbd6p4amnsjm7w5yiu2ixr2rnx6qk2pnhtnbn4oa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250107-yem9psvrg1/

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e84bcbd0-5655-4212-892a-878d2045595f

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/368d9c9d203dc9e6047e7f00c6c92cfdbb845348bc7516dfd0569ed3cda16f1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.