MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487
SHA3-384 hash: 45e62a0f227e0e8a8f8d55d67ccd86b1904dc96da4ed83bef47f562f532b095d025295b20040031d9a531c1bf8195f4f
SHA1 hash: abceceacfdecc0ff9751db15c66df60e5c31c5e3
MD5 hash: 82c2b8da0f70ae735d84e86085ff2786
humanhash: seven-ink-six-orange
File name:82c2b8da0f70ae735d84e86085ff2786
Download: download sample
Signature Mirai
Create hunting rule
File size:22'704 bytes
First seen:2023-05-13 18:43:32 UTC
Last seen:2023-05-13 21:30:45 UTC
File type: elf
MIME type:application/x-executable
ssdeep 384:Ma6R9gWWe+6napkdlDMFhjgxBeKdnqvBz2FqAXaNBFe09ch/B3ik0Iipi9v1RNn:V6D51SFux8Kdnqv1A4je8cn3iDpANn
TLSH T1EFA2E1A14BD9E026DD84DBB932CF588E543275C397D2D714BED7A0DE93830893419E2E
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 elf intel mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.20230513212740263439836.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug mirai obfuscated
Link:
https://www.filescan.io/uploads/645fda74446f9ce94a65a55c/reports/c3ad273d-3931-4fe4-b481-5c4ce22db7be/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
4
Number of processes launched:
7
Processes remaning?
true
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
141.98.6.124:45
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c31f8bac-b306-45a2-9495-29972e12ffa6
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1232199
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 865182 Sample: hmOwZjKATJ.elf Startdate: 13/05/2023 Architecture: LINUX Score: 72 42 50.52.59.60 ZIPLY-FIBER-LEGACY-ASNUS United States 2->42 44 66.104.249.154 XO-AS15US United States 2->44 46 98 other IPs or domains 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Mirai 2->52 54 2 other signatures 2->54 10 hmOwZjKATJ.elf 2->10         started        signatures3 process4 process5 12 hmOwZjKATJ.elf 10->12         started        14 hmOwZjKATJ.elf 10->14         started        16 hmOwZjKATJ.elf 10->16         started        process6 18 hmOwZjKATJ.elf 12->18         started        20 hmOwZjKATJ.elf 12->20         started        22 hmOwZjKATJ.elf 14->22         started        24 hmOwZjKATJ.elf 14->24         started        26 hmOwZjKATJ.elf 14->26         started        process7 28 hmOwZjKATJ.elf 18->28         started        30 hmOwZjKATJ.elf 18->30         started        32 hmOwZjKATJ.elf 18->32         started        34 hmOwZjKATJ.elf 22->34         started        36 hmOwZjKATJ.elf 22->36         started        process8 38 hmOwZjKATJ.elf 28->38         started        40 hmOwZjKATJ.elf 28->40         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-05-13 18:44:08 UTC
File Type:
ELF32 Little (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4js4yxpcw2oizxxbdmdzglt6lleydjnhxuwdr7snbddkgtvusdq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora botnet linux upx
Link:
https://tria.ge/reports/230513-xdf9bsha29/
Behaviour
Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 37132e62ef15b4e466f708d83c9973f2d64c0d2d3de961c7f26846351a75a487

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2631326/

Comments


Avatar
zbet commented on 2023-05-13 18:43:38 UTC

url : hxxp://141.98.6.124/bins/Tempus.x86