MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74c0e2446b2a9296726914c090fb8b199a459112a5c444e5ab45c8ea8a004e32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74c0e2446b2a9296726914c090fb8b199a459112a5c444e5ab45c8ea8a004e32
SHA3-384 hash: 7bd75289b4a0c22229a66a0a57936bb35d93392c8f9ba1d060aa4655618fed57dd29dbc26ff9f87720d2b693008c3d73
SHA1 hash: 67a6069154f69279eb7a253d332c7692e18d78ff
MD5 hash: 09ad5843f3ef9f5c3aec0d1175c92d08
humanhash: grey-early-nineteen-edward
File name:09ad5843f3ef9f5c3aec0d1175c92d08
Download: download sample
Signature Mirai
Create hunting rule
File size:62'592 bytes
First seen:2022-04-10 10:27:28 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:oagv1AOp/umClcqsexyYGsYh4lSijKmR7GrxhCKkdV8:ox11KmqsWI40iGm2xhKV8
TLSH T12D539E63C4641DA4C1548AB0B9288FB61763E60087637FF5426ACBA99057EFCF60E3F5
Reporter zbetcheckin
Tags:32 elf mirai renesas

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Dropper.Mirai-7136015-0
Create hunting rule

Unix.Trojan.Mirai-7138377-0
Create hunting rule

Unix.Trojan.Mirai-7674518-0
Create hunting rule

Unix.Trojan.Mirai-9876194-0
Create hunting rule

Unix.Trojan.Generic-9910199-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug remote.exe
Link:
https://www.filescan.io/uploads/6252b13504b81dabe2727dee/reports/da6faafa-37bf-4b37-8398-cd4a7982acf9/overview
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34ae4cfe-9829-4e84-9abb-103c16eddb55
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/974001
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 606488 Sample: M6jU6bI72u Startdate: 10/04/2022 Architecture: LINUX Score: 76 18 5.17.148.46 ZTELECOM-ASRU Russian Federation 2->18 20 14.162.220.163 VNPT-AS-VNVNPTCorpVN Viet Nam 2->20 22 98 other IPs or domains 2->22 24 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Mirai 2->28 30 Uses known network protocols on non-standard ports 2->30 8 M6jU6bI72u 2->8         started        signatures3 process4 process5 10 M6jU6bI72u 8->10         started        process6 12 M6jU6bI72u 10->12         started        14 M6jU6bI72u 10->14         started        16 M6jU6bI72u 10->16         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/74c0e2446b2a9296726914c090fb8b199a459112a5c444e5ab45c8ea8a004e32/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-04-10 10:28:06 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai linux
Link:
https://tria.ge/reports/220410-mhmxkacgh8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/74c0e2446b2a9296726914c090fb8b199a459112a5c444e5ab45c8ea8a004e32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 74c0e2446b2a9296726914c090fb8b199a459112a5c444e5ab45c8ea8a004e32

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2139835/

Comments


Avatar
zbet commented on 2022-04-10 10:27:31 UTC

url : hxxp://2.56.59.37/bins/sh4