MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ebd801755dd7d4e3b65e2b3be8d3a5e1d0f3f8aa47287e25e90e4f4b5df9f7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	6ebd801755dd7d4e3b65e2b3be8d3a5e1d0f3f8aa47287e25e90e4f4b5df9f7f
SHA3-384 hash:	c775e48cc3125ab9c6ada3bc4666c31dededcbdc07b243c4ad67245c1f21878bcf41f37587d2ca80ab7318308828b3c7
SHA1 hash:	0186b8f38a2453d02a3f4d73dbf7be38860e7376
MD5 hash:	276f8a2334a9a2f382fab1eb1c487681
humanhash:	zulu-hamper-berlin-glucose
File name:	jklm68k
Download:	download sample
Signature	Mirai Create hunting rule
File size:	62'764 bytes
First seen:	2024-12-24 02:36:09 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:XilMfwO1MJucthpzMyr1aDIzuHaKKKKKbo5ytYucoDn0uAc8NgD3yP9:XilMfwO1MJucthpoycIu6KKKKKbkeY+4
TLSH	T1FD534B86A400DC3CF85BEA7FC8166A00F564B72456930F37A7EAFD93AC73099BD19941
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

224

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Unix.Trojan.Mirai-6981989-0

Unix.Trojan.Mirai-7755770-0

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Mirai-9940650-0

Unix.Trojan.Mirai-10008934-0

Unix.Trojan.Mirai-10018298-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676a1e568a4d48ee35feb8d3linux22vpnfull_triage

Tags:

malware

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/676a1e55dfd3fc9d659fa1aa/reports/d75001f1-6554-4f8b-8a06-489204c7b2cb/overview

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ccd86a0e-a7e7-4e0d-b774-8ec32a41b06b

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1580205

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/6ebd801755dd7d4e3b65e2b3be8d3a5e1d0f3f8aa47287e25e90e4f4b5df9f7f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ebd801755dd7d4e3b65e2b3be8d3a5e1d0f3f8aa47287e25e90e4f4b5df9f7f/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-12-24 02:37:09 UTC

File Type:

ELF32 Big (Exe)

AV detection:

13 of 23 (56.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n26yaf2v3v6u4o3f4kz35dj2lyoq6p4kurzipys6sdspjno7t57q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/241224-c359jazkbw/

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-6981989-0

YARA:

n/a

Link:

https://app.threat.zone/submission/4093ae93-ebf8-42f4-94d1-0a87b4e89f5b

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6ebd801755dd7d4e3b65e2b3be8d3a5e1d0f3f8aa47287e25e90e4f4b5df9f7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.