MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181
SHA3-384 hash: 4f70401555367793b4c3f5327383f7fe9def75ba5fe6940619c789013f781e7b89aad6844c2f1bf3da76689e3516ccf3
SHA1 hash: 1818bec170005816443ec17d356f4b5005ccf277
MD5 hash: f25b730b8011f367c1d1ef46adcd7e1d
humanhash: idaho-florida-video-lion
File name:f25b730b8011f367c1d1ef46adcd7e1d
Download: download sample
Signature Mirai
Create hunting rule
File size:27'300 bytes
First seen:2023-08-22 21:10:00 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:AMKyhegCCMqfizjoNpd2vJdX6vwr8T9q3UELuw:nKy4qfqoeJdXWg8SLh
TLSH T1E9C2D0A07726F931C5206C3DE52B4D8A3A91063CD1FF393664158C398FC1A9B67B88F9
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 arm elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-9955692-0
Create hunting rule

Unix.Trojan.Mirai-9955694-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/64e5242caa97e3ec0d1ada6a/reports/80569f07-83c3-4f81-81ca-c35ce3cfc1a9/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3500b29b-b560-45e4-8783-d37868e9383a
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1295520
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-08-22 21:10:05 UTC
File Type:
ELF32 Little (Exe)
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhbvwk7t5aq3clpm5g3rhe3ohp6gydn7h7gorv7wlliz4cnqugaq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd botnet upx
Link:
https://tria.ge/reports/230822-zz1k7sgh3z/
Behaviour
Reads runtime system information
Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2706258/

Comments


Avatar
zbet commented on 2023-08-22 21:10:00 UTC

url : hxxp://45.15.158.128/hiddenbin/boatnet.arm6