MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe
SHA3-384 hash: b4bb25c6739d2c2db44aafe81321cd65c15ef0bd8b558397fa1a96c5546d31fc25acc79cfc4166c7d7c359b12f5def58
SHA1 hash: 2a90508ff941c8e3e8cac95b9f6ae6dc84c7a648
MD5 hash: e58ce318bb382ccff209b664bbaaf84a
humanhash: equal-july-three-jersey
File name:e58ce318bb382ccff209b664bbaaf84a
Download: download sample
Signature Mirai
Create hunting rule
File size:27'244 bytes
First seen:2022-04-21 19:26:05 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB9WP:5CrJgHiOJrfwmQrctA
TLSH T165C2D0DFF48679C5CC1C5CBC25CD5AD115A9A3C3234A9F0837103DC9A97645EB8AC8B8
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 elf mips mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-7831925-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/6261afd4ffe27d511926f966/reports/95ae23f7-af11-41a1-b951-bf8cb91858c9/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
UPX
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b3e6b16-19a7-4243-838b-2c5507620313
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/980973
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 613464 Sample: Qy8uJU6Oby Startdate: 21/04/2022 Architecture: LINUX Score: 68 24 205.187.66.29 WINDSTREAMUS United States 2->24 26 43.245.97.65 VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG Singapore 2->26 28 98 other IPs or domains 2->28 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Uses known network protocols on non-standard ports 2->36 38 Sample is packed with UPX 2->38 8 Qy8uJU6Oby 2->8         started        signatures3 process4 process5 10 Qy8uJU6Oby 8->10         started        12 Qy8uJU6Oby 8->12         started        15 Qy8uJU6Oby 8->15         started        signatures6 17 Qy8uJU6Oby 10->17         started        20 Qy8uJU6Oby 10->20         started        22 Qy8uJU6Oby 10->22         started        40 Sample tries to kill multiple processes (SIGKILL) 12->40 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-04-21 19:27:05 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220421-x53lmsfff9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 8343c067f6a59bef63a92e982f56f79fb3b124706755e65db0c8a778c2ca38fe

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2158952/

Comments


Avatar
zbet commented on 2022-04-21 19:26:08 UTC

url : hxxp://185.44.81.86/bins/sora.mpsl