MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 716804dc52929e19b87c3d81e69250c79abaec9a8741ee5ebb80a6e2dcbccdbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	716804dc52929e19b87c3d81e69250c79abaec9a8741ee5ebb80a6e2dcbccdbb
SHA3-384 hash:	500f7dcbf4c963d0b86fdfd8789854fabe7b62be31e35d8290cf9e853a303d9c010636c9a8bfb8eb0b075188a12a4e16
SHA1 hash:	be599b329f8dbe63defa47de6e9ce1c090213587
MD5 hash:	91a5fb3a9855dc6a0f64b8ba4ca2d89b
humanhash:	massachusetts-nine-cardinal-jersey
File name:	armv4l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	81'672 bytes
First seen:	2025-01-05 01:21:49 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:l7yomQFigoEGcFSZmNMGW/aQJNAKz2dZwW16c9UldWbBdvLGnB7y0OnrqtBZk:ZyoCEGeOaI0itBZ
TLSH	T1F3834A857D818622C9D0327BFA2E66CD336257E4E2EB72178D215F2577DAC2B0E37241
telfhash	t1bad01225db6046c923b2430583dc532396d9f18a076375f01ca86b821957991f52ba15
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

164

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai.8670.19702.26.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6779e00774a2bd296e2739c4linux22vpnfull_triage

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/6779debbf325b9aaf79cc92d/reports/9e9c7eb2-20fd-4406-a5d0-d014d1dcf0ce/overview

Result

Verdict:

UNKNOWN

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f4d9ae65-f829-4cea-9dd0-c82cd11f0b02

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1584278

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Performs DNS TXT record lookups

Sample deletes itself

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/716804dc52929e19b87c3d81e69250c79abaec9a8741ee5ebb80a6e2dcbccdbb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/716804dc52929e19b87c3d81e69250c79abaec9a8741ee5ebb80a6e2dcbccdbb/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2025-01-05 01:22:05 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 23 (60.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ofuajxcsskpbtod4hwa6nesqy6nlv3e2q5a64xv3qctofxf4zw5q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250105-bq8nfsylhq/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1e6c8c04-9638-495f-8f8b-657284678460

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/716804dc52929e19b87c3d81e69250c79abaec9a8741ee5ebb80a6e2dcbccdbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.