MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4531055787bdf40bc227b678922785a5f8e3994bf3efd2f611cc50d408a0f8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1

SHA256 hash: 4531055787bdf40bc227b678922785a5f8e3994bf3efd2f611cc50d408a0f8dc
SHA3-384 hash: 56b11b293d16ba5869bd5928c49d70d424f8dce07c57e449abeb68f3eead5c49dc9f63bde0fa4640a3d307b2880b4f40
SHA1 hash: d843aa17a4843b19a9bb67839e0a6a565dc8c99b
MD5 hash: 8b9b5682e14d09f74ef586ebd9c2023a
humanhash: twenty-sad-washington-stream
File name:8b9b5682e14d09f74ef586ebd9c2023a
Download: download sample
Signature Mirai
File size:119'920 bytes
First seen:2022-08-06 04:09:21 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:aiNnGlqUjjaP1AKl0Py/tYaGKJ5NctVRa:BnGlq/0st3
TLSH T1E8C33B86AC91D925CBC223B7FA2F108D331593DCD2EA72439D281F6836CB55E1E37646
telfhash t1dd51f067a7a82faca7e444e8d1ae512afbb0349193113485c10edb0fdf43c93b51ac23
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter @zbetcheckin
Tags:32 arm elf mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
140
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Result
Threat name:
Detection:
malicious
Classification:
troj
Score:
64 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679624 Sample: Kr9mYMyujR Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 Kr9mYMyujR 2->7         started        process3 process4 9 Kr9mYMyujR 7->9         started        11 Kr9mYMyujR 7->11         started        13 Kr9mYMyujR 7->13         started        process5 15 Kr9mYMyujR 9->15         started        17 Kr9mYMyujR 9->17         started        19 Kr9mYMyujR 9->19         started        21 11 other processes 9->21
Threat name:
Linux.Trojan.Mirai
Status:
Malicious
First seen:
2022-07-27 04:11:49 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 4531055787bdf40bc227b678922785a5f8e3994bf3efd2f611cc50d408a0f8dc

(this sample)

  
Delivery method
Distributed via web download

Comments



Avatar
zbet commented on 2022-08-06 04:09:24 UTC

url : hxxp://46.23.109.47/Cloud/Cloud.arm