MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5
SHA3-384 hash:	b78d3c0bcf3deae19f3241445b0167e7f6380aed1ba8398ab7a7ef1833bed969365e752156b75f3810f6f6a605127261
SHA1 hash:	b50c9f825c629673931710f807ae81c4be338020
MD5 hash:	f3292014da5ff571426ade8a7a3aa4b6
humanhash:	xray-december-may-cola
File name:	dlr.arm6
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'456 bytes
First seen:	2024-11-10 09:06:10 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	24:lpKGpa7Urz/jlf2CAXK1hH9Vev3gRGaJ9iM3BBuDCWlxrR+zP6eF0:lpKGpa7UrLZ24I+JhBumWlxrsPLF
TLSH	T1BA31F191A3D05E78CCE491BEEE5643507374AF40E0C7726296086758BD29E7C9D26046
telfhash	t1ff9002264f1f88509650020c84e50651c8d4d2530a0068d4499d0e0085529107464240
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.507.7626.12234.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=673077fc6c614f3030a3fa34linux22vpnfull_triage

Tags:

mirai virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sends data to a server

Connection attempt

Receives data from a server

Creating a file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android anti-debug masquerade

Link:

https://www.filescan.io/uploads/673077ba0ff06db3291a70fb/reports/d12bc278-e150-462e-96ea-07d8ae881621/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a81435b0-5600-4178-9226-7426952b3185

Joe Sandbox Mirai, Okiru

Result

Threat name:

Mirai, Okiru

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1553080

Signature

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5/

ReversingLabs TitaniumCloud Linux.Backdoor.Mirai

Threat name:

Linux.Backdoor.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-09 17:47:49 UTC

File Type:

ELF32 Little (Exe)

AV detection:

23 of 38 (60.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iljhzbfduavlvayymkgwjwk2upihqi744za5xdgrwizaaomechkq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:lzrd botnet

Link:

https://tria.ge/reports/241110-k3bc6atglb/

Behaviour

Writes file to tmp directory

Mirai

Mirai family

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9abce9a2-1269-4ebe-832c-0c2eca4bb34b

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/42d27c84a3a02aba8318628d64d95aa3d07823fce641db8cd1b23200398411d5