MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5573fc70c149f6676e1bae8e8a07d916b1690aeb06320689e17a54651c2c7133. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	5573fc70c149f6676e1bae8e8a07d916b1690aeb06320689e17a54651c2c7133
SHA3-384 hash:	e84bafd2a72c37573033bf4251eb800948206d5cbdc352db98c87666212768cf5a95bd67f67b3279aea444b1985c7fce
SHA1 hash:	f22995b45888eb2e462dd4830c09447b51f0625b
MD5 hash:	66c1934eb66b04f7d9f7f08439311384
humanhash:	princess-blossom-mango-table
File name:	jklppc
Download:	download sample
Signature	Mirai Create hunting rule
File size:	56'000 bytes
First seen:	2025-03-10 00:36:47 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:0f9zv0z7wxRFdRRgA4MpmFhy3ug73mM++X59TzRXGCZgAEYM:O9D0fQ1L4d7yr3j++dDZbEx
TLSH	T1EC43490272180987D6665EF0383F1BE083BEEE9021F0B689695FDB568276F371146F9D
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ce35d41f777fe306087253linux22vpnfull_triage

Tags:

mirai

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

DNS request

Sends data to a server

Opens a port

Creating a file

Receives data from a server

Runs as daemon

Substitutes an application name

Performs a bruteforce attack in the network

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c099bdc0-9f92-48fe-a161-f88a93cc241d

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1633177

Signature

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5573fc70c149f6676e1bae8e8a07d916b1690aeb06320689e17a54651c2c7133

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/5573fc70c149f6676e1bae8e8a07d916b1690aeb06320689e17a54651c2c7133/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-03-10 00:37:13 UTC

File Type:

ELF32 Big (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kvz7y4gbjh3go3q3v2hiub6zc2ywscxlayzancpbpjkgkhbmoezq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:botnet linux

Link:

https://tria.ge/reports/250310-ayj5dswxgv/

Verdict:

Malicious

Tags:

Unix.Dropper.Mirai-7135957-0

YARA:

n/a

Link:

https://app.threat.zone/submission/8f2fc8f7-76c0-4e5d-a182-caa52198ddea

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/5573fc70c149f6676e1bae8e8a07d916b1690aeb06320689e17a54651c2c7133

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.