MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e036c11d0906bc3bf42ea2a23e21dae0aef386e61d5a1d5213f028a50b333f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments 1

SHA256 hash:	3e036c11d0906bc3bf42ea2a23e21dae0aef386e61d5a1d5213f028a50b333f3
SHA3-384 hash:	30e381d495a511dc39a024e49b368dc7ba33324208b35259099230ce9959929350be340a80fb3636793f0e64b208ab57
SHA1 hash:	87cd6e6c32688f649af452987b624afa682d0c9d
MD5 hash:	171b599b8e05fb54ae8619988fe75e3a
humanhash:	oscar-freddie-kitten-quebec
File name:	171b599b8e05fb54ae8619988fe75e3a
Download:	download sample
Signature	Mirai Create hunting rule
File size:	50'384 bytes
First seen:	2022-04-16 00:10:32 UTC
Last seen:	2022-04-17 14:50:04 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:Gg/4bxmnqQRQzOLo+RniNkqUDz7RMLPVLl7RqNZBHXnCqCVOn17Q8C/NAfwb1w:N4bLQRCOLKY3UplrVme2I
TLSH	T1AF33295578C18F16C9D056BBFA2E428C372A53E8E2EF33139D226F51368781F0E67651
telfhash	t12ef09e309f0c2ec87bd00d4583fe876b24257cdafab0450343a58d8e8311ed1b555634
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

220

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai.1232.30507.2811.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug mirai

Link:

https://www.filescan.io/uploads/625a0996ffe27d5119e05f09/reports/13721716-2dc4-4fc8-b021-4d3c099d993c/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/3e036c11d0906bc3bf42ea2a23e21dae0aef386e61d5a1d5213f028a50b333f3

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b4781569-ae0c-4a9a-bf32-051e5e44a735

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/977559

Signature

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/3e036c11d0906bc3bf42ea2a23e21dae0aef386e61d5a1d5213f028a50b333f3/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2022-04-15 19:34:16 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 39 (35.90%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/220416-agla5ahbg4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3e036c11d0906bc3bf42ea2a23e21dae0aef386e61d5a1d5213f028a50b333f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.