MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8
SHA3-384 hash:	78f5a9acd0f8abb58b646cc22bc5c9971f0c8e965b5f19ab4fb19d05864df73a517ec8143c90c3f5e74b908f3fc98078
SHA1 hash:	32df578c1f3d81347abfd3721ca60e1008717854
MD5 hash:	bd3185db4953f033ae8b712fe6a4c862
humanhash:	winter-uranus-west-michigan
File name:	jklarm7
Download:	download sample
Signature	Mirai Create hunting rule
File size:	79'264 bytes
First seen:	2025-03-04 02:27:31 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:ZxnLMmXQlUv/yzBReuUbsyFwH4ZDF4e48bYoHjZpb3uNlj8iYbrk+0s:4mAljzBR1UbjHZDFDVbYoHjZpU+brnl
TLSH	T10A73F645F8819F11C5D822BAFA5E018D33675BA8E3EEB212DE105F25778A91F0F77902
telfhash	t1ebe0c222de9c99d8a7f4937c99e8590c49f832a563514c568c481b6a80024c6306f909
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.29229.LC.UNOFFICIAL

Unix.Trojan.Mirai-9970440-0

Unix.Trojan.Mirai-1

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c6660fc668b65489bed212linux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Runs as daemon

Creating a file

Opens a port

Receives data from a server

Sends data to a server

Substitutes an application name

Performs a bruteforce attack in the network

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67c6654f4a3011c802c6b2d0/reports/dce38307-7cb4-4676-87f1-07aae3e54f4c/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

Full report:

https://elfdigest.com/brief/46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

UNKNOWN

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6e585f7b-a7de-4277-8bc1-dafb9563e6d1

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1628703

Signature

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-03-04 02:28:35 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i26qfgew4lithaax65ne53huqrljn57s2xuqacza2c3zb5oorxua._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:botnet credential_access defense_evasion discovery

Link:

https://tria.ge/reports/250304-cx9prsxk12/

Behaviour

Reads runtime system information

Changes its process name

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

Modifies Watchdog functionality

Renames itself

Unexpected DNS network traffic destination

Contacts a large (178658) amount of remote hosts

Creates a large amount of network flows

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-9970440-0

YARA:

n/a

Link:

https://app.threat.zone/submission/cf8f9370-9c26-4e2f-8903-beb98a5ef825

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/46bd029896e2d1338017f75a4eecf4845696f7f2d5e9000b20d0b790f5ce8de8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.