MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831
SHA3-384 hash:	606e4f87ecfe47255eb74acb40f5e2d911a17c429d1cc9f0d4a0e24f6b77259c1e0b1b3ff9e3c59c6a83c85b67033f4a
SHA1 hash:	24079e0e9ebcbd829d2e41e9b07df8e75a75642f
MD5 hash:	cdeb2c1b0358b81df3044dd8c7a60f81
humanhash:	lion-echo-september-fruit
File name:	skyljne.x86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	98'664 bytes
First seen:	2023-12-16 20:12:04 UTC
Last seen:	2023-12-23 17:10:47 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:f26qGog9lc4FMHkyvWzgj98S2mcnpHTw:uTTglOlKWcpzw
TLSH	T19CA36BC0F283D4F2EC4709B11176AF375733E0BA2519FA42C369A936DC92551EA1BB9C
telfhash	t11e5128fa5ebe0cecf3c06844c75e5fc22969d73b2561b2f641622ca523e3d568076839
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	elfdigest
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

458

# of downloads :

110

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28959.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7135898-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9945193-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9946826-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9950762-0

Alert

Create hunting rule

Unix.Dropper.Mirai-10008433-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug lolbin masquerade remote

Link:

https://www.filescan.io/uploads/657e04ce439457868c0462e9/reports/35576d4c-caed-4016-8770-3d8d967a2acd/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

103.178.235.42

Number of open files:

46

Number of processes launched:

3

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

type:Moobot 103.178.235.42:19990

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/04a51385-c183-47b1-a670-66374fe02cb6

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1363505

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 17:33:34 UTC

File Type:

ELF32 Little (Exe)

AV detection:

26 of 37 (70.27%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q47fivpeevyxeg5gqo7goxsbyg2tqrdq2nolqt32jrg2wvd4tayq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

linux

Link:

https://tria.ge/reports/231216-yzdwrscgej/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/873e5455e42571721ba683be675e41c1b5384470d35cb84f7a4c4dab547c9831