MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c58714e73e90af2e481dca0e772c18d38878934c6c9de747d9de4997b227ad6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments 1

SHA256 hash: 4c58714e73e90af2e481dca0e772c18d38878934c6c9de747d9de4997b227ad6
SHA3-384 hash: c407f6539caffdbe22de3cc328cdb2af128987e8a206fd415b017e7308cf6a3c5464ecf0ae3e2aba2d6831afd4c9a368
SHA1 hash: 8ec9d983a5fe3331d828e21a5016e2012ef7a1ba
MD5 hash: a88fe5d28e2f429c1a9f3f6962d791dc
humanhash: floor-saturn-oregon-item
File name:a88fe5d28e2f429c1a9f3f6962d791dc
Download: download sample
Signature Mirai
File size:146'762 bytes
First seen:2022-08-06 03:05:07 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:QQWK7q4d3HcKMLASEyzKYvdrAFwwztgiQv9VvzeUTUDT01wfm8S8lDngh/aJN:nWhUnFwT1Mbzt4v9VvzeUy4Gfm+tnBz
TLSH T159E3E707F9518A53C5D157BAF69F06883726B764C3DB33039988AF702F4E5982E6E2D0
telfhash t17921f34184b2ce2e6ea2dbe49aed56e255914f1327083f725e38899cd025063911fd9a
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter @zbetcheckin
Tags:32 arm elf gafgyt mirai

Intelligence


File Origin
# of uploads :
1
# of downloads :
146
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
mirai
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
81
Number of processes launched:
9
Processes remaning?
false
Remote TCP ports scanned:
9530,26,23
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
46.23.109.40:8688
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Result
Threat name:
Detection:
malicious
Classification:
troj
Score:
60 / 100
Signature
Multi AV Scanner detection for submitted file
Sets full permissions to files and/or directories
Yara detected Mirai
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679610 Sample: Z8xEavXrld Startdate: 06/08/2022 Architecture: LINUX Score: 60 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 9 Z8xEavXrld 2->9         started        process3 process4 11 Z8xEavXrld 9->11         started        process5 13 Z8xEavXrld 11->13         started        process6 15 Z8xEavXrld sh 13->15         started        17 Z8xEavXrld sh 13->17         started        19 Z8xEavXrld 13->19         started        21 3 other processes 13->21 process7 23 sh chmod 15->23         started        26 sh mv 15->26         started        28 sh mkdir 17->28         started        signatures8 34 Sets full permissions to files and/or directories 23->34
Threat name:
Linux.Trojan.Mirai
Status:
Malicious
First seen:
2022-08-06 03:06:06 UTC
File Type:
ELF32 Little (Exe)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:myMirai
Description:Mirai
Rule name:setsockopt
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:unixredflags3
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 4c58714e73e90af2e481dca0e772c18d38878934c6c9de747d9de4997b227ad6

(this sample)

  
Delivery method
Distributed via web download

Comments



Avatar
zbet commented on 2022-08-06 03:05:15 UTC

url : hxxp://46.23.109.47/snickers/arm