MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7
SHA3-384 hash: 3dfe4ac97858041ed25ac3ab6dadfead1061d541854c47a96ee6c9a7e7ed5c5e511b3aa50410dbad65bfd810f1417db3
SHA1 hash: 995e6329fd4f8d033ccc6d05b34624cadad3805b
MD5 hash: 26405033f67598033d42c892bc920c92
humanhash: wyoming-georgia-west-carbon
File name:26405033f67598033d42c892bc920c92
Download: download sample
Signature Mirai
Create hunting rule
File size:28'052 bytes
First seen:2022-06-24 11:01:27 UTC
Last seen:2022-06-24 12:42:38 UTC
File type: elf
MIME type:application/x-executable
ssdeep 384:o9eFuhzIZtQGDfYWgwkeDeQFcrvIzPTydGQBiqJzFNMyTmi2EEi3hymdGUop5h3:okFueZPAWgjQCvQczLrAEEi3s3Uoz1
TLSH T1BDC2D0205169BC21CB7119B6CF18D9422B264FB9F339317222794977F84B94968BC2EF
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 arm elf mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/62b599ece88d6da4ffc23948/reports/c4557d7a-6799-480b-b389-d36c960a012f/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
UPX
Botnet:
unknown
Number of open files:
33
Number of processes launched:
6
Processes remaning?
false
Remote TCP ports scanned:
23
Full report:
https://elfdigest.com/brief/b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7
Behaviour
Information Gathering
Botnet C2s
TCP botnet C2(s):
62.197.136.92:9506
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ef8f0546-ba4a-4e8d-bd4c-be761a29e291
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1019285
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 651781 Sample: oesJv1hdmc Startdate: 24/06/2022 Architecture: LINUX Score: 60 28 67.149.12.103, 23 WOW-INTERNETUS United States 2->28 30 98.19.197.45, 23 WINDSTREAMUS United States 2->30 32 98 other IPs or domains 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected Mirai 2->36 38 Sample is packed with UPX 2->38 8 dash rm oesJv1hdmc 2->8         started        10 python3.8 uname 2->10         started        12 dash tr 2->12         started        14 10 other processes 2->14 signatures3 process4 process5 16 oesJv1hdmc 8->16         started        18 oesJv1hdmc 8->18         started        20 oesJv1hdmc 8->20         started        process6 22 oesJv1hdmc 16->22         started        24 oesJv1hdmc 16->24         started        26 oesJv1hdmc 16->26         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-06-24 11:02:06 UTC
File Type:
ELF32 Little (Exe)
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=whsoyge72hspcbamsyzzaddlbfgw3gptbnaqd47v3kd7os37qp3q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220624-m44r7sbggp/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b1e4ec189fd1e4f1040c9633900c6b094d6d99f30b4101f3f5da87f74b7f83f7

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2248817/

Comments


Avatar
zbet commented on 2022-06-24 11:01:30 UTC

url : hxxp://62.197.136.92/shitnet//irc.arm5