MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853
SHA3-384 hash: 1dec819f814d087257d781e1a42929dc5b22ba4e93f75c1822d91f43f7d9dcb22b4d85fa3b4e01d21e23bd2f39b5cd00
SHA1 hash: 93bebef6c1ade4fdb1d3ccab46885816dd69b55b
MD5 hash: 5bc9688cb03b615116105ba7a86c69df
humanhash: oxygen-kansas-delaware-burger
File name:armv4l
Download: download sample
Signature Mirai
Create hunting rule
File size:66'988 bytes
First seen:2025-02-17 07:32:04 UTC
Last seen:2025-02-17 08:44:13 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:J03TkWTpIvOmlVuCG6tYRvVvl98oYimP41QhyUKy+KuxZVSgjvlkV7elhTT7oIro:Mh8LGoCN98ojmP41Q9fCxZUCEK3voFE
TLSH T1C6632885BD819A12C5E43277FA2E52CC335627E8E2DA72278D225F11B7CAC3B0D37651
telfhash t115d022b30f2459ea17049b1280da631c0eb1f2977f15b08022840b98001354af92fd2b
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai.8670.5260.11281.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67b2e6f3a0fd713c335b6130linux22vpnfull_triage
Tags:
mirai
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
true
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
15
Number of processes launched:
2
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853
Behaviour
Anti-VM
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
type: 172.217.192.127:3478
Result
Verdict:
UNKNOWN
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bbd0ffd7-10cb-4001-a7e2-ea0461c5b07f
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1616807
Signature
Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1616807 Sample: armv4l.elf Startdate: 17/02/2025 Architecture: LINUX Score: 60 20 iranistrash.libre 2->20 22 86.104.72.130, 35038, 995 TELE-ROM-ASstrAleeaPaciiBlB5Ap16RO Romania 2->22 24 4 other IPs or domains 2->24 26 Multi AV Scanner detection for submitted file 2->26 8 armv4l.elf 2->8         started        11 dash rm 2->11         started        13 dash rm 2->13         started        signatures3 28 Performs DNS TXT record lookups 20->28 process4 signatures5 30 Sample deletes itself 8->30 15 armv4l.elf 8->15         started        process6 signatures7 32 Opens /sys/class/net/* files useful for querying network interface information 15->32 18 armv4l.elf 15->18         started        process8
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-02-17 07:32:11 UTC
File Type:
ELF32 Little (Exe)
AV detection:
9 of 37 (24.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hvhhfp4cdwibwrcvsi6n2pprygiq6ati7ovoc5je5bl5m4klhbjq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/250217-jcz36avqhx/
Behaviour
Enumerates kernel/hardware configuration
Changes its process name
Reads system network configuration
Reads MAC address of network interface
Reads network interface configuration
Deletes itself
Unexpected DNS network traffic destination
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/633114a9-1084-48fb-9f21-4bc1a83ab3a5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Generic_Threat_d94e1020
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh f2b3c553390029d05be3e8b5ef986d995268ec304d4e19287c259f6e0c8ed915

Mirai

elf 3d4e72bf821d901b4455923cdd3df1c1910f0268fbaae17524e857d6714b3853

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3391505/
  
Delivery method
Distributed via web download
  
Dropped by
SHA256 f2b3c553390029d05be3e8b5ef986d995268ec304d4e19287c259f6e0c8ed915
  
Dropped by
MD5 f9560f2b4edd17379e916831cde44c15
  
Dropped by
SHA256 66514f8b850bcbac9276ba5d148391e323b87b34e19d0b8a91a0f80312cae457
  
Dropped by
MD5 cdf791171f54817ca57d5a3bdde6d536
  
Dropped by
SHA256 ee0a3c2335fe9d89789a4197c13a7b7712fb4e2c92b75afb7c8d67ad5f53e0c2
  
Dropped by
MD5 f820b6ea3691154b685cd83b86b37a41
  
Dropped by
SHA256 2d2c4732b5b1657e0573443570e0614b2d9481ffba803b26748ec6a67aa0e684
  
Dropped by
MD5 812c3a914ede9b8bb3af3ea124e9172a
  
Dropped by
SHA256 9abade2c9b95237eb73bf0c1a303bcf8e221924889ece88b0af1d5bc25e63d08
  
Dropped by
MD5 6ab1b6574058ffce777d35fc89045f2a
  
Dropped by
SHA256 4d19fccd54164e9de354ad76d81d2a21cfa776df9ac22b68f0e346addd849626
  
Dropped by
MD5 e5dcf4789265519a08b1f53b7b88d493
  
Dropped by
SHA256 c629334ced1b587c325addfc30227fd2c40839a571437699b2497a550dee58c4
  
Dropped by
MD5 826a2e8c62c436b81df0a25ef5d340df
  
Dropped by
SHA256 f10ef85d4c781e71078d479d05763193674c5c80604be8e1f6e9e53599076fb7
  
Dropped by
MD5 d0666044aea9206484f742f1863b8645
  
Dropped by
SHA256 56e8bb0c5b2344b5d12304c65e499c09dc30732152ba2ec9fe0c6a2426c9d81a
  
Dropped by
MD5 bbaa3229cad46691d0834301f7c5dbde
  
Dropped by
SHA256 b697a01d0fd7a8b5ff8321fc5e6b8d88ca66d67a9f13cad175ed5ba84f5c3af3
  
Dropped by
MD5 6dbbbaea2e4c6c91336db4fd2b074ea4
  
Dropped by
SHA256 8cfeefa83c28bd9781372fe40752af05b8a2b5c7e9a422dc04d2928a756a1b3b
  
Dropped by
MD5 1549cd2cf9fe5e4cf3bdef05d2817c18
  
Dropped by
SHA256 960f3f905aa7413f713415f2834e07bcfd342ac85432e1fa62c49542b39db517
  
Dropped by
MD5 5425429b0bd97014f7a5c108d5ba8d71
  
Dropped by
SHA256 25325ed59aa3f2671f93e11424fb0d2773ed09db1452753ca218ac50a6280e76
  
Dropped by
MD5 abbfce0d20d14f2e20d7b959afdd9d89
  
Dropped by
SHA256 368307076927b62b1cf02d951f1d6706eb544eee2b8d958f74de81f4d53b5a34
  
Dropped by
MD5 1b3ef0e22af5abf7b22013c44e723b3d

Comments