MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a
SHA3-384 hash: 30b79e0fe3457a7f52e703d7c5b29144ae7341976f6461084f0d2138c6031b02dd0b41623163a98a8055151c0996f757
SHA1 hash: 0393077654e7d306a54045f970d3705ede10cf53
MD5 hash: 76e001f4dbf4f5917daa8d1613e5dc91
humanhash: yellow-aspen-sodium-pip
File name:sora.x86
Download: download sample
Signature Mirai
Create hunting rule
File size:27'196 bytes
First seen:2021-12-12 20:50:03 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:Fv5SaxsIEJC5cJnEY2zkQZB+Xm9/juD2zw1nbcuyD7UHQRjU:55S745cawDXajuUsnouy8HyQ
TLSH T1BFC2D003D6BCD714C4AA51F498DFF7061090F99F2209EBDAAF4428D71DA1B986828BE5
Reporter tolisec
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Dropper.Mirai-7135858-0
Create hunting rule

Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1734/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/61b6607e2a069372660f0013/reports/17bedce5-18a8-48ed-a603-cfcebdf985b1/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
23.94.37.59:80/bins
Number of open files:
16
Number of processes launched:
7
Processes remaning?
false
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
23.94.37.59:81
UDP botnet C2(s):
not identified
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bdf5faea-4368-4b7a-937b-c046b9ae78e2
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/906060
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 538539 Sample: sora.x86 Startdate: 12/12/2021 Architecture: LINUX Score: 52 30 Multi AV Scanner detection for submitted file 2->30 32 Sample is packed with UPX 2->32 8 sora.x86 2->8         started        10 systemd sshd 2->10         started        12 systemd sshd 2->12         started        process3 process4 14 sora.x86 8->14         started        16 sora.x86 8->16         started        18 sora.x86 8->18         started        process5 20 sora.x86 14->20         started        22 sora.x86 14->22         started        24 sora.x86 14->24         started        26 sora.x86 14->26         started        process6 28 sora.x86 20->28         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2021-12-12 20:50:12 UTC
File Type:
ELF32 Little (Exe)
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211212-zmlaradggk/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5088f194c0dacd9769ec6d662283a78405774ff52e246e61ba3cf56b23ca540a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1878705/
  
Delivery method
Distributed via web download

Comments