MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b
SHA3-384 hash: 4917447b7563de2fc5698d4becf9b523803c1f90c2f746f6f00cc33e64ea36919b04492bbaff0e7e7d8e5edc0f5e8003
SHA1 hash: aa6ccdb61a8ac376cd2f010d72a5ee9917e918bc
MD5 hash: 7bf3198a4fc4849ffb8423871fb10370
humanhash: hawaii-island-speaker-whiskey
File name:7bf3198a4fc4849ffb8423871fb10370
Download: download sample
Signature Mirai
Create hunting rule
File size:31'776 bytes
First seen:2021-11-01 03:31:01 UTC
Last seen:2021-11-01 05:12:17 UTC
File type: elf
MIME type:application/x-executable
ssdeep 384:xWS4x/IyACoKkwwWPb5hkecMZTAdHbB/5VMmHWK7XGpVgVtSBRWGVCz0NvEN:xQYVMZE9bFr/O6SfWP
TLSH T116E2D1AE71EDA589C98D5C3E549DBAB58B1070D22AC76B9013718488F91FF8F7C481BC
Reporter zbetcheckin
Tags:32 elf mips mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai.14.9592.29146.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
UPX
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/793c930b-54e3-46fd-8191-fffea51929f0
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/880123
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Reads system files that contain records of logged in users
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill many processes (SIGKILL)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 512557 Sample: INsMwWSMeh Startdate: 01/11/2021 Architecture: LINUX Score: 100 87 197.212.239.102 ZAIN-ZAMBIAZM Zambia 2->87 89 184.49.234.47 WAYPORTUS United States 2->89 91 98 other IPs or domains 2->91 97 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->97 99 Malicious sample detected (through community Yara rule) 2->99 101 Multi AV Scanner detection for submitted file 2->101 103 3 other signatures 2->103 10 gdm3 gdm-session-worker 2->10         started        12 gdm3 gdm-session-worker 2->12         started        14 systemd accounts-daemon 2->14         started        17 43 other processes 2->17 signatures3 process4 file5 20 gdm-session-worker gdm-x-session 10->20         started        22 gdm-session-worker gdm-x-session 12->22         started        105 Reads system files that contain records of logged in users 14->105 24 accounts-daemon language-validate 14->24         started        85 /var/log/wtmp, data 17->85 dropped 26 INsMwWSMeh 17->26         started        28 accounts-daemon language-validate 17->28         started        30 accounts-daemon language-validate 17->30         started        32 6 other processes 17->32 signatures6 process7 process8 34 gdm-x-session dbus-daemon 20->34         started        37 gdm-x-session Xorg Xorg.wrap Xorg 20->37         started        39 gdm-x-session dbus-daemon 22->39         started        41 gdm-x-session Xorg Xorg.wrap Xorg 22->41         started        43 language-validate language-options 24->43         started        49 8 other processes 26->49 45 language-validate language-options 28->45         started        47 language-validate language-options 30->47         started        51 2 other processes 32->51 signatures9 93 Sample reads /proc/mounts (often used for finding a writable filesystem) 34->93 53 dbus-daemon 34->53         started        55 Xorg sh 37->55         started        57 dbus-daemon 39->57         started        59 Xorg sh 41->59         started        61 language-options sh 43->61         started        63 language-options sh 45->63         started        65 language-options sh 47->65         started        95 Sample tries to kill many processes (SIGKILL) 49->95 process10 process11 67 dbus-daemon false 53->67         started        69 sh xkbcomp 55->69         started        71 dbus-daemon false 57->71         started        73 sh xkbcomp 59->73         started        75 sh locale 61->75         started        77 sh grep 61->77         started        79 sh locale 63->79         started        81 sh grep 63->81         started        83 2 other processes 65->83
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2021-11-01 01:45:32 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211101-d2216adgcj/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf 90b97df163d6e7acf82b8daad1b4a95f9aec912f36bfc454853cd4d001a3a74b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1734496/

Comments


Avatar
zbet commented on 2021-11-01 03:31:02 UTC

url : hxxp://23.94.37.59/bins/Tsunami.mpsl