🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9
SHA3-384 hash: 4aca3c2d80597c686c447a5d90beb6407551e3471707fe0f703676eed1f29e6522fbb81a303e778f34bab75479a68d4b
SHA1 hash: efbb44996943f8de1c52898cb98dd3e14b08ca62
MD5 hash: 3284143eef9632f0c73ac051e02f4e82
humanhash: fix-emma-december-pennsylvania
File name:3284143eef9632f0c73ac051e02f4e82
Download: download sample
Signature Mirai
Create hunting rule
File size:24'728 bytes
First seen:2021-07-20 09:12:48 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:MaDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLG:H/QOC0Yhn6ROHWFGrcwNVFCnNBxcvec4
TLSH T175B2E1D5D6FB2BC3C2D1C336D07C994DE6721AC10347440A2109B64EA6A764E9BFB3E5
Reporter zbetcheckin
Tags:32 elf intel mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-7829191-0
Create hunting rule

Unix.Trojan.Mirai-7832354-0
Create hunting rule

Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
89.108.70.79:80/bins
Number of open files:
16
Number of processes launched:
7
Processes remaning?
true
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
89.108.70.79:1312
UDP botnet C2(s):
not identified
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d52d7fe-71a2-40f4-a929-f88f5d8a69e5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/818796
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 451224 Sample: 9Rka7BK2rI Startdate: 20/07/2021 Architecture: LINUX Score: 64 44 80.139.201.90 DTAGInternetserviceprovideroperationsDE Germany 2->44 46 41.60.62.66 ZOL-ASGB Mauritius 2->46 48 98 other IPs or domains 2->48 50 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Uses known network protocols on non-standard ports 2->54 56 Sample is packed with UPX 2->56 10 9Rka7BK2rI 2->10         started        12 systemd sshd 2->12         started        signatures3 process4 process5 14 9Rka7BK2rI 10->14         started        16 9Rka7BK2rI 10->16         started        18 9Rka7BK2rI 10->18         started        process6 20 9Rka7BK2rI 14->20         started        22 9Rka7BK2rI 14->22         started        24 9Rka7BK2rI 16->24         started        26 9Rka7BK2rI 16->26         started        28 9Rka7BK2rI 16->28         started        process7 30 9Rka7BK2rI 20->30         started        32 9Rka7BK2rI 20->32         started        34 9Rka7BK2rI 20->34         started        36 9Rka7BK2rI 24->36         started        38 9Rka7BK2rI 24->38         started        process8 40 9Rka7BK2rI 30->40         started        42 9Rka7BK2rI 30->42         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2021-07-20 09:13:04 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/210720-lk9d3mfrce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 48c1a53bc380203c5bcee32ea69ab0eaf20888776ed6008d505774211bc18fa9

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1468063/

Comments


Avatar
zbet commented on 2021-07-20 09:12:48 UTC

url : hxxp://89.108.70.79/bins/sora.x86