MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5
SHA3-384 hash: 3f9a51273703b75efdc8f45cfe7b7d896b46d64e90eb419e9a376ece5fbfde8d68a3b082755aedf8972d4982007d0738
SHA1 hash: e79fce16c068dc93e39dff21126d9d8452c43bd8
MD5 hash: 23e852f26ecf7fb0f4eacb20eb5bce3e
humanhash: twenty-timing-lamp-spring
File name:23e852f26ecf7fb0f4eacb20eb5bce3e
Download: download sample
Signature Mirai
Create hunting rule
File size:34'108 bytes
First seen:2021-12-22 05:46:30 UTC
Last seen:2021-12-22 05:50:03 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:Jm7W7svboqIemDKtE8npV3r8xIhtZWudtVTcVYKWh+lnbcuyD7UryqA:JmRqK1pV3QI/Vnelnouy8mqA
TLSH T1A8E2E0A386C88AE4F4EF94B9185F7F87182DD04ED045193FB6EC3537C9212283D48A5A
Reporter zbetcheckin
Tags:32 elf gafgyt intel mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.DarkNexus-7679166-0
Create hunting rule

Unix.Trojan.Mirai-7669677-0
Create hunting rule

Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2909/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/61c2bbd98991ba72b3916f3e/reports/686bca12-5617-44ad-a3f5-676cd51e1deb/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
custom
Botnet:
209.141.42.170:80/SBIDIOT
Number of open files:
2
Number of processes launched:
3
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
209.141.42.170:13369
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/90f14759-7856-4466-8ca3-a5ed8fd846fa
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/911377
Signature
Multi AV Scanner detection for submitted file
Opens /proc/net/* files useful for finding connected devices and routers
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543857 Sample: zL2WPiPk1J Startdate: 22/12/2021 Architecture: LINUX Score: 60 21 209.141.42.170, 13369, 33870 PONYNETUS United States 2->21 23 109.202.202.202, 80 INIT7CH Switzerland 2->23 25 2 other IPs or domains 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected Mirai 2->29 8 dash rm zL2WPiPk1J 2->8         started        11 dash cat 2->11         started        13 dash tr 2->13         started        15 6 other processes 2->15 signatures3 process4 signatures5 31 Opens /proc/net/* files useful for finding connected devices and routers 8->31 17 zL2WPiPk1J 8->17         started        process6 process7 19 zL2WPiPk1J 17->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2021-12-22 05:47:08 UTC
File Type:
ELF32 Little (Exe)
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211222-ggwkesfgfn/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf afc8b3cc6789eaff2d3256ea06337600fc5d33b28e11d41d75b3a7e359902cb5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1909524/

Comments


Avatar
zbet commented on 2021-12-22 05:46:31 UTC

url : hxxp://209.141.42.170/SBIDIOT/x86