MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9
SHA3-384 hash:	fe5450193b9c40fd3af56ba4bc266164ebe37adc90f9fe58062f26c9d59bafb2cd5e154c7f87f0956b2771e40b1dce32
SHA1 hash:	39f450476768cc45a5684b57ac716353f8134064
MD5 hash:	9929c883706f527e9261ddada3056759
humanhash:	lake-indigo-lake-potato
File name:	9929c883706f527e9261ddada3056759
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'480 bytes
First seen:	2024-06-28 14:00:02 UTC
Last seen:	2024-06-28 14:34:25 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	24:cc5KGpa7Urz/jlfIOXK1G9Vev3gRGD9i8/NBuLlp/v9gOuN:cc5KGpa7UrLZINR3dNBur3hC
TLSH	T13631F1D153E05DBDC8E415BEAE6BC310B3A89F44E1CA7123930C73287D1AD7C9D26059
telfhash	t1cb900262474fbb68b245018048c90104c5e4e51b0460986145491c404852a107510210
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

114

Origin country :

FR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.523.6396.20163.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fd61a443-08d4-4f80-9a1e-add1365c040d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1464210

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9

CERT.PL MWDB mirai

Detection:

mirai

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-06-28 14:01:04 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rrj3m23g772buaaitfrwlh2qhtf52inztmol5qx7jz7l5b6glpmq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/240628-raznlstaqa/

Behaviour

Writes file to tmp directory

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/8c53b66b66fff41a00089963659f503ccbdd21b99b1cbec2ff4e7ebe87c65bd9

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-06-28 14:00:02 UTC

url : hxxp://212.70.149.164:8080/dlr.arm7