MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 10 File information Comments 1

SHA256 hash:	5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494
SHA3-384 hash:	85894a01639e80bd6ced7a7e9b0a48b4a00506f69aadba9fdf282ec1a880c7b5aa20c8ab844759fc2989354d49833ac1
SHA1 hash:	63360959a97eded2983c15f72a063725df1c9b2f
MD5 hash:	de2afda43604324fc51e4346286f69a2
humanhash:	saturn-harry-grey-apart
File name:	de2afda43604324fc51e4346286f69a2
Download:	download sample
Signature	Mirai Create hunting rule
File size:	49'748 bytes
First seen:	2023-05-27 00:04:31 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:F8X8nS4UzeBeMJiEgWebkgN6IX/iz3gUb4fLSZpqn6MqI2tYfVGjC:F8X8nSDeMMsEVCogUbA2PMqZYfP
TLSH	T19223198D58412E2CEAD66CFD14624F099E556312E0E34A0FA7BEFEC33CB3268AF15544
telfhash	t14fe02600ac688b5c58d79a74ee9d0bb49905a22354664b04cf10d7e0883f858a30de5e
Reporter	zbetcheckin
Tags:	32 elf mirai motorola

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug botnet mirai obfuscated obfuscated

Link:

https://www.filescan.io/uploads/647149ae2bb33fab4d109d61/reports/7333c15a-4dfa-4f21-b056-716ba0c6d3fb/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d61dbe50-f91e-48c9-97ec-1064f15094bf

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1243549

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2023-05-27 00:05:07 UTC

File Type:

ELF32 Big (Exe)

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ls5ieb5pwlwffpakj2kj6s7ibl5vjgvrn6h4d4r4vrwrqdzmkska._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd linux

Link:

https://tria.ge/reports/230527-ac622ahg35/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Mirai_Generic Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Mirai/Gafgyt samples

Rule name:	Linux_Trojan_Mirai_95e0056c Create hunting rule
Author:	Elastic Security

Rule name:	Mirai_Botnet_Malware Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	Mirai_Botnet_Malware_RID2EF6 Create hunting rule
Author:	Florian Roth
Description:	Detects Mirai Botnet Malware
Reference:	Internal Research

Rule name:	myMirai Create hunting rule
Description:	Mirai

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2642144/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-05-27 00:04:32 UTC

url : hxxp://45.128.232.143/bins/paraiso.m68k