MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5
SHA3-384 hash: 5d43387ef9fe1db26932531734b937631d398eaf79ca690d16090b0b04f407d4b1fe97a0b8b7ae20931ec64675232459
SHA1 hash: 4aa8d144f35d4866de88ea1e05a285bba69ef1be
MD5 hash: a97cba648f47f81741dc2b95e93fd013
humanhash: tennis-crazy-table-comet
File name:phantom.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:23'340 bytes
First seen:2023-03-04 14:00:06 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:LELcyo6qLQjF+yr/iwMbauKb/7LMojG3IrQD6TTDzQJkv4JjxhymdGUop5hG:YLcyrbsciwMbyb/d8QTncA4Ds3UozM
TLSH T18DA2D1242BDE4DF1C22206728137C39173535BBDE1CB7528532849A8E3EE58678F94DD
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter elfdigest
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-8274771-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/64034f1f66e79c93ba0db978/reports/c54839f4-14ca-4529-be8a-4095cebfa5a6/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
45.95.169.158:80/bins
Number of open files:
52
Number of processes launched:
15
Processes remaning?
true
Remote TCP ports scanned:
2323,23
Full report:
https://elfdigest.com/brief/39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
45.95.169.158:1312
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c00a57a-d433-4438-9693-9a8383843748
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1187125
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 820001 Sample: phantom.arm.elf Startdate: 04/03/2023 Architecture: LINUX Score: 64 42 165.59.212.229 ZAMTELZM Zambia 2->42 44 123.19.95.174 VNPT-AS-VNVNPTCorpVN Viet Nam 2->44 46 98 other IPs or domains 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Mirai 2->50 52 Uses known network protocols on non-standard ports 2->52 54 Sample is packed with UPX 2->54 10 phantom.arm.elf 2->10         started        signatures3 process4 process5 12 phantom.arm.elf 10->12         started        14 phantom.arm.elf 10->14         started        16 phantom.arm.elf 10->16         started        process6 18 phantom.arm.elf 12->18         started        20 phantom.arm.elf 12->20         started        22 phantom.arm.elf 14->22         started        24 phantom.arm.elf 14->24         started        26 phantom.arm.elf 14->26         started        process7 28 phantom.arm.elf 18->28         started        30 phantom.arm.elf 18->30         started        32 phantom.arm.elf 18->32         started        34 phantom.arm.elf 22->34         started        36 phantom.arm.elf 22->36         started        process8 38 phantom.arm.elf 28->38         started        40 phantom.arm.elf 28->40         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-03-04 14:02:21 UTC
File Type:
ELF32 Little (Exe)
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hhdq3x6k7y5p5q3jdtn7t6unzznxhjolabrvdlb64zulviz3ltsq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230304-rbjc1seb92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 39c70ddfcafe3afec3691cdbf9fa8dce5b73a5cb006351ac3ee668baa33b5ce5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2557976/
  
Delivery method
Distributed via web download

Comments