MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b
SHA3-384 hash:	0677d4757b8cb68636bba79a2bda1f4a37bcea33a8beff3fde3d140d6b637342da4df7d60edd0831bc34888d7c641dfe
SHA1 hash:	877140c5f10d355863564e51a01f7a0fa062027c
MD5 hash:	31c5f506f09a530b2bd8a5dc24b6e488
humanhash:	oxygen-bulldog-sad-solar
File name:	wlw68k
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	163'072 bytes
First seen:	2024-12-26 03:16:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:h4D8oZsd2+JgtwnzRRj7neVs8k7DVcjbiILR2tyxa/NYng:OIoP6nzRd7eG8k8LYyxUNYng
TLSH	T187F33ACBF801CDBDF80AF33648270D19B530B7D151825B3B2257B96BED3A1991963E86
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

218

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28886.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-6981989-0

Alert

Create hunting rule

Unix.Trojan.Gafgyt-7782058-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9940650-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9970440-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10012509-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10017111-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10018298-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676ccaaf75bf3268d2fe87bclinux22vpnfull_triage

Tags:

malware

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/676ccaae509459c7f80514d2/reports/d1792036-171f-44a1-8e6f-78320008ccf3/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b30df55c-5254-4723-8a3d-44b5369d626e

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1580761

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-26 03:17:04 UTC

File Type:

ELF32 Big (Exe)

AV detection:

19 of 38 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kw6m4arzbxuvedtmh3w3m5bxl5ebkvxf65lhharbotqnh2qqjenq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/241226-ds13hawjgm/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

trojan gafgyt Unix.Trojan.Mirai-6981989-0

YARA:

Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024

Link:

https://app.threat.zone/submission/a9985bea-5207-4176-b0f5-52d7c1bf9bb3

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b