MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf
SHA3-384 hash:	a4c5fea2e6ca2bd0a23448a5037a356aa25c5dde607e2fc94e5d98deede36abcec7d79ceeb13527b77fc0cba43bd95ed
SHA1 hash:	59034bb21b4584c420305fc4b85b17c3851dfaea
MD5 hash:	8733d552de33f075fdd894d5b0a1ee79
humanhash:	texas-happy-california-oregon
File name:	nabx86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	37'956 bytes
First seen:	2024-11-28 07:31:25 UTC
Last seen:	2024-12-20 08:55:35 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:+rGBw+LVgmZJQC/QSJM7Rpq9pPoS8qd1KZ9qYKKQR:+rGBwQQSe7RpOQS8qDq9qYKKQR
TLSH	T1370339459943D9B6FC5416F124BB9B72A7B1D9718475FA03EB9AD530AE02302B90F3CC
telfhash	t14621d0a0aeb100f8f3d0bc4dab1e179267759937296165be40f06ed136e3213e135856
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

97

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-7755770-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885259-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10008934-0

Alert

Create hunting rule

Unix.Trojan.Gafgyt-6735924-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67481dead0583382434b9f05linux22vpnfull_triage

Tags:

phishing mirai

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sends data to a server

Receives data from a server

Creating a file

Runs as daemon

Opens a port

Substitutes an application name

Performs a bruteforce attack in the network

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/67481c748f37cc1861ff5233/reports/9ecb782b-1149-41b1-911c-b4911b5b0f0e/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

58

Number of processes launched:

5

Processes remaning?

true

Remote TCP ports scanned:

23

Full report:

https://elfdigest.com/brief/65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ef433e60-4f42-4778-afe9-a6bd8143e6d1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1564348

Signature

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf/

ReversingLabs TitaniumCloud Linux.Backdoor.Mirai

Threat name:

Linux.Backdoor.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-28 07:32:04 UTC

File Type:

ELF32 Little (Exe)

AV detection:

22 of 38 (57.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mxrpvqvkaztkrrp7erhb54hwcem5ylozu5vkaqvd7uynsfupi3hq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery linux rootkit

Link:

https://tria.ge/reports/241128-jcx9kawner/

Behaviour

Loads a kernel module

Unexpected DNS network traffic destination

Contacts a large (1868) amount of remote hosts

Threat.Zone Malicious

Verdict:

Malicious

Tags:

trojan mirai Unix.Trojan.Mirai-7755770-0

YARA:

Linux_Trojan_Mirai_88de437f Linux_Trojan_Mirai_cc93863b Linux_Trojan_Mirai_8aa7b5d3

Link:

https://app.threat.zone/submission/9a8ed8ec-8b6e-4dfe-b6dd-9d14b13ebfd5

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/65e2fac2aa0666a8c5ff244e1ef0f61119dc2dd9a76aa042a3fd30d9168f46cf