MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments 1

SHA256 hash:	6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5
SHA3-384 hash:	a488cda05ee736c1e4bfa1e115d31bf1eaeb2a580707e323ec994e9c2e79bb6c6dedd5d85694b19dd79cbb3e82cba3af
SHA1 hash:	182302886f7eb9b55cea034302c4957b6d5a2507
MD5 hash:	dec4a6cdf3f930f8ea5b0a71f4aff8a5
humanhash:	zebra-florida-nine-alabama
File name:	dec4a6cdf3f930f8ea5b0a71f4aff8a5
Download:	download sample
Signature	Mirai Create hunting rule
File size:	51'260 bytes
First seen:	2024-04-18 11:19:25 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:3AxXceNpbZ0cVSHwi/7q0eJlgPYZt54v5OHRoBKCCCTDMIxZ:3UMeNpbicVFi/7qDQPet2wmBdCCTn
TLSH	T10E338D71CC782D48E69C82B4B5709F7EAB53A501D5871EBC946B9626A003FDCF94D2F0
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 elf gafgyt mirai renesas

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d4c3ccdc-3a64-4459-8b0a-40257128bf62

Result

Threat name:

Mirai

Detection:

malicious

Classification:

spre.troj

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1428051

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5/

Threat name:

Linux.Trojan.Gafgyt

Status:

Malicious

First seen:

2024-04-17 22:03:06 UTC

File Type:

ELF32 Little (Exe)

AV detection:

18 of 36 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nvwwwkjdihbr2erwywkqt4qq2urgc5wjjapvcyomvwv6gpwaep2q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/240418-nfec3sbd83/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research