MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
SHA3-384 hash: ff67d7241580ff7d0a27e66942260d4b6a15a08692183fe02e70c48b438cd06a809dd377eeaeb5bc1d3be36068908b6e
SHA1 hash: ea7c97294f415dc8713ac8c280b3123da62f6e56
MD5 hash: 8f4fff0ded94f1141768220906abfbb8
humanhash: stairway-mango-august-fanta
File name:xmrig
Download: download sample
Signature Mirai
Create hunting rule
File size:8'297'712 bytes
First seen:2024-12-02 06:07:02 UTC
Last seen:2025-09-18 10:09:22 UTC
File type: elf
MIME type:application/x-executable
ssdeep 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
telfhash t1b1123fb489e534f5a2dac857f363f1b5aa3304e266f835f052227e41dfe4d814ca7826
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
8
# of downloads :
108
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
PUA.Unix.Coinminer.XMRig-6683890-0
Create hunting rule

Multios.Coinminer.Miner-6781728-2
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=674d500904c232bff3b5c07clinux22vpnfull_triage
Tags:
ransomware xmrig virus
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
android anti-debug coinminer gcc miner monero xmrig
Link:
https://www.filescan.io/uploads/674d4ec22ed0555438f21746/reports/b4b860e9-e842-4451-919e-6323cd98a06e/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c98568c-1026-4419-892c-fe16ef39e630
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
mine
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1566408
Signature
Found strings related to Crypto-Mining
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Stdout / stderr contain strings indicative of a mining client
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d/
Threat name:
Linux.Trojan.Miner
Create hunting rule
Status:
Malicious
First seen:
2024-11-04 22:38:22 UTC
File Type:
ELF64 Little (Exe)
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdq243lt2zllea2rj5eywwolz4u7az7n6355hab2hxt5eglaqsgq._file
Result
Malware family:
xmrig_linux
Create hunting rule
Score:
  10/10
Tags:
family:xmrig family:xmrig_linux antivm discovery linux miner
Link:
https://tria.ge/reports/241202-gvcdpssphv/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Checks CPU configuration
Reads CPU attributes
Checks hardware identifiers (DMI)
Reads hardware information
Xmrig_linux family
xmrig
Verdict:
Unknown
Tags:
cryptojacking xmrig
YARA:
MAL_ELF_XMRig_Jul_09 XMRIG_Monero_Miner MacOS_Cryptominer_Xmrig_241780a1
Link:
https://app.threat.zone/submission/a7090a57-901c-4933-938f-abff8ca0df5f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:Linux_Trojan_Pornoasset_927f314f
Create hunting rule
Author:Elastic Security
Rule name:MacOS_Cryptominer_Xmrig_241780a1
Create hunting rule
Author:Elastic Security
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:XMRIG_Monero_Miner
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Monero mining software
Reference:https://github.com/xmrig/xmrig/releases
Rule name:xmrig_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

Mirai

elf b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3317417/
  
Delivery method
Distributed via web download
  
Dropped by
SHA256 82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97
  
Dropped by
MD5 52f6ef322dd61383cc5f03bba971ecc1

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments