MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4872dd3f32ed477778cb4496de9ce20b0a6b1baa75687b949fc0c5d4d7f026e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	4872dd3f32ed477778cb4496de9ce20b0a6b1baa75687b949fc0c5d4d7f026e0
SHA3-384 hash:	74efa69b5ad1f391a03349a950e24f4a047e318f50eb8dd7019e9a2b201278be39c3b110ac6fc09a663c0bf379b3aac0
SHA1 hash:	c393a137e8ad3cfc8f61a0ae1eb6a126ca9bc560
MD5 hash:	900583167627a913f83fae56f4e45771
humanhash:	earth-skylark-carpet-pip
File name:	splppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	61'496 bytes
First seen:	2024-10-28 06:47:26 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:Jn08HDu/rRy4S3jVoEAAojMvcoS8Fj5onI8sRy:J0oDsEaMFdonI0
TLSH	T1EE535C42720C4A13C55A4AB0183F57F093BFAA5022F4B3C9794EAB7B8675E371186F9D
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Dropper.Mirai-7135957-0

Unix.Trojan.Mirai-7755770-0

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Gafgyt-9940653-0

Unix.Trojan.Mirai-10008934-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671f33a95928ee28d55e8206linux22vpnfull_triage

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sends data to a server

Receives data from a server

Creating a file

Runs as daemon

Opens a port

Substitutes an application name

Performs a bruteforce attack in the network

Verdict:

Unknown

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/671f33a47b6de3d3d3560636/reports/4d91791d-5265-4316-9c42-dcd7d6a539e0/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fe005b4b-8585-4bf4-812e-69c6552219e8

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1543642

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/4872dd3f32ed477778cb4496de9ce20b0a6b1baa75687b949fc0c5d4d7f026e0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4872dd3f32ed477778cb4496de9ce20b0a6b1baa75687b949fc0c5d4d7f026e0/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-10-28 06:48:05 UTC

File Type:

ELF32 Big (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jbzn2pzs5vdxo6glisln5hhcbmfgwg5kovuhxfe7ydc5jv7qe3qa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/241028-hkrw3sshlf/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8729c4f0-e65d-4fd5-b4ee-3b2d341d5c13

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4872dd3f32ed477778cb4496de9ce20b0a6b1baa75687b949fc0c5d4d7f026e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.