MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e17b8355cdb2b3b935ebe8af55207b3ba688cd759df172c33c015ed4d664595. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7e17b8355cdb2b3b935ebe8af55207b3ba688cd759df172c33c015ed4d664595
SHA3-384 hash:	f0ac474ae9f7e73b74e7f9ffbd6b11851458ba63f7ec479ad17b4eaf429e5723c6596ce786f427ca6ac9933734a5a7c6
SHA1 hash:	417f870ad6259f842000f8ccfe8180cdc4b89e48
MD5 hash:	87cb30e200bcee45315efd81030b592e
humanhash:	kitten-vegan-don-virginia
File name:	skyljne.arm
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	140'160 bytes
First seen:	2023-12-16 20:12:07 UTC
Last seen:	2023-12-23 17:10:31 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:m1E8W/Jm+F78I4VAlkvbA5sfLZ9aCoDq/:m1yJbt8I4V8kvbAKZ9aCoY
TLSH	T1BFD31945F9505B23C6D312B7FB5E428D7B2A17E8E3EE720399215F60378A86B0D37542
telfhash	t1c211b1690f940a6d27f081c9d345987b17397c2e88633d068eae9c5fc117ae13518157
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	elfdigest
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

152

# of downloads :

107

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28886.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28959.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7135898-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9945193-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9946826-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9950762-0

Alert

Create hunting rule

Unix.Dropper.Mirai-10008433-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug lolbin masquerade mirai remote

Link:

https://www.filescan.io/uploads/657e04d06b1c246046f7411f/reports/fcbdf6f3-5fbb-4a0e-9f18-af9038675819/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/97732782-e3ba-4c2b-80db-e9f8f369d4d9

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1363504

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/7e17b8355cdb2b3b935ebe8af55207b3ba688cd759df172c33c015ed4d664595

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e17b8355cdb2b3b935ebe8af55207b3ba688cd759df172c33c015ed4d664595/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 17:00:47 UTC

File Type:

ELF32 Little (Exe)

AV detection:

25 of 37 (67.57%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pyl3qnk43mvtxe26x2fpkuqhwo5grdgxlhprolbtyak62tlgiwkq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai

Link:

https://tria.ge/reports/231216-yzdwrsebb5/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

Malware Config

C2 Extraction:

bngoc.skyljne.click

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/7e17b8355cdb2b3b935ebe8af55207b3ba688cd759df172c33c015ed4d664595