MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849
SHA3-384 hash: 3ad5f548b4492aab9fa2e097b77fd1c7212eae8cd1de2c6211ed14424af034aa50613ecd918a89913bd5f4e16d162683
SHA1 hash: 89a625ad3b058c0d7a0e6be3a95b167d2afa9e45
MD5 hash: 77616269ff23f10f8b794232b63ab11d
humanhash: angel-missouri-earth-cola
File name:sora.arm
Download: download sample
Signature Mirai
Create hunting rule
File size:25'000 bytes
First seen:2022-04-16 05:50:06 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:DwBA1NjQwcThlYlYXoKrEas4ccUcfhJJ0Ks3UozB:DwBA1NcwcThuuXosq4czcfPSzB
TLSH T14DB2D09133216074CA941F35CD78C1EC726B2A88F2FD22232A190575B7D758B27F868F
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter tolisec
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-8274771-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/625a5947ffe27d5119e3558e/reports/b47403cd-46fd-4443-a37b-81b9e4e5a4bb/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
2.56.59.37:80/bins
Number of open files:
56
Number of processes launched:
13
Processes remaning?
true
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
2.56.59.37:1312
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8233b4d7-aa96-455b-bf24-236a7fff881b
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/977605
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 610092 Sample: sora.arm Startdate: 16/04/2022 Architecture: LINUX Score: 68 24 46.6.172.37 XFERAES Spain 2->24 26 42.104.204.186 VODAFONE-INVodafoneIndiaLtdIN India 2->26 28 98 other IPs or domains 2->28 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Uses known network protocols on non-standard ports 2->36 38 Sample is packed with UPX 2->38 8 sora.arm 2->8         started        signatures3 process4 process5 10 sora.arm 8->10         started        12 sora.arm 8->12         started        15 sora.arm 8->15         started        signatures6 17 sora.arm 10->17         started        20 sora.arm 10->20         started        22 sora.arm 10->22         started        40 Sample tries to kill multiple processes (SIGKILL) 12->40 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-03-30 04:13:07 UTC
File Type:
ELF32 Little (Exe)
AV detection:
25 of 42 (59.52%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220416-gj5wwacffl/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 50da6da00b3a2b5841e0d7950b8e37dfd6dbadf3c85f26d54585c0308b02d849

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2150077/
  
Delivery method
Distributed via web download

Comments