MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11
SHA3-384 hash:	1d0ecdb9389841d9a7f6ebc27e21ab2459c28b069cfd858a53aec290708f1f57292fc3ec2275d5f285dfb46079301c03
SHA1 hash:	b5f75df5373bb687e5c5f192751c3d481abe126b
MD5 hash:	55f28b45e50a4bcf009e894cc4ec5640
humanhash:	queen-north-beryllium-alpha
File name:	nuklear.arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	75'052 bytes
First seen:	2024-11-06 15:26:37 UTC
Last seen:	2024-11-06 17:28:58 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:zRnfJjv1a6nmrjCHDl48AMS2A37X6KckIZi5y8lK:njvI6nlC8XbWX6Iy8l
TLSH	T1C8732A85F8815B25C6C606BBFA1F008E330657E8E2DF73139D201FA477CA95B0D26E5A
telfhash	t1b0111c7749ab6adc7bc0c32c129b016ac75d32b91b5216499f6d178982437e0f340802
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=672b8ace49e92a05dde387bblinux22vpnfull_triage

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug masquerade

Link:

https://www.filescan.io/uploads/672b8aca182e63505d6194de/reports/13be96fa-61d7-4740-a364-dd06bb1c6809/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cd542f45-c4b1-4878-adab-9266cad07953

Result

Threat name:

Mirai, Moobot

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1550325

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Yara detected Moobot

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-11-06 15:47:13 UTC

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pbflwoyo43ndn3mrdd34betkgwe3jx2gny2p2fvl2lsghykwlqiq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:owari

Link:

https://tria.ge/reports/241106-svq3ms1rf1/

Malware Config

C2 Extraction:

cnc.carteldesinaloa.ru

Verdict:

Malicious

Tags:

trojan gafgyt Unix.Dropper.Mirai-7135890-0

YARA:

Linux_Trojan_Gafgyt_28a2fe0c Linux_Trojan_Gafgyt_ea92cca8 Linux_Gafgyt_May_2024

Link:

https://app.threat.zone/submission/b1d0497c-7da9-4a48-8efd-5fc70e6dbd95

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/784abb3b0ee6da36ed9118f7c0926a3589b4df466e34fd16abd2e463e1565c11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_Yakuza Create hunting rule
Author:	NDA0E
Description:	Yakuza botnet

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Trojan_Gafgyt_28a2fe0c Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Gafgyt_ea92cca8 Create hunting rule
Author:	Elastic Security

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research