MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac
SHA3-384 hash: 7f9327cbb3a12c3375d0871efad2bd27caa7ba25741878f17dd95f2ee2c801d08f9a5931a31cfcce18654c9bcbfaf30a
SHA1 hash: f3521c5c40b05fbec723b3493ba7535f743823ba
MD5 hash: 321ba14143f6d6fe893151e1e1f6711b
humanhash: kilo-butter-georgia-cat
File name:fuckunix.ppc
Download: download sample
Signature Mirai
Create hunting rule
File size:55'784 bytes
First seen:2025-01-04 13:21:38 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:x7oHk68IU1VlmrzBmyBtfFqLPIAhb+10mdT:xUX8I6Hm3h3F0PIgej
TLSH T184436C42B31C0A07D0631EB0343F5FD09BAFEED122E4B685699F9BA68435E731546E8D
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28880.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.28886.LC.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.28959.LC.UNOFFICIAL
Create hunting rule

Unix.Dropper.Mirai-7135957-0
Create hunting rule

Unix.Dropper.Mirai-7136013-0
Create hunting rule

Unix.Dropper.Mirai-7139230-0
Create hunting rule

Unix.Trojan.Mirai-8025795-0
Create hunting rule

Unix.Trojan.Mirai-9441505-0
Create hunting rule

Unix.Trojan.Mirai-9858729-0
Create hunting rule

Unix.Trojan.Mirai-9940367-0
Create hunting rule

Unix.Trojan.Mirai-9950762-0
Create hunting rule

Unix.Trojan.Mirai-10011027-0
Create hunting rule

Unix.Trojan.Mirai-10011918-0
Create hunting rule

Unix.Trojan.Mirai-10012201-0
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=677936c074a2bd296e269844linux22vpnfull_triage
Tags:
gafgyt mirai ddos
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
DNS request
Runs as daemon
Opens a port
Receives data from a server
Sends data to a server
Substitutes an application name
Performs a bruteforce attack in the network
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug masquerade obfuscated
Link:
https://www.filescan.io/uploads/677935ff6443af9e2d6715ba/reports/c5324b92-3184-413d-b0f9-15ec877aa979/overview
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/534338ed-805c-4ae9-94ae-09bd149e00f7
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1584153
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1584153 Sample: fuckunix.ppc.elf Startdate: 04/01/2025 Architecture: LINUX Score: 72 24 Malicious sample detected (through community Yara rule) 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Mirai 2->30 8 fuckunix.ppc.elf 2->8         started        process3 process4 10 fuckunix.ppc.elf 8->10         started        process5 12 fuckunix.ppc.elf 10->12         started        14 fuckunix.ppc.elf 10->14         started        16 fuckunix.ppc.elf 10->16         started        18 fuckunix.ppc.elf 10->18         started        process6 20 fuckunix.ppc.elf 12->20         started        22 fuckunix.ppc.elf 14->22         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-01-04 13:22:07 UTC
File Type:
ELF32 Big (Exe)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wippu2hyauziaydbxovqz6ekoldlzxpm6leeayxecx4jehibbcwa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:condi linux
Link:
https://tria.ge/reports/250104-ql79fs1lbs/
Malware Config
C2 Extraction:
report.condinet.cf
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Dropper.Mirai-7135957-0
YARA:
Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024
Link:
https://app.threat.zone/submission/0d82711e-3305-42f5-b0aa-04c237c4e7b4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b21efa68f80532806061bbab0cf88a72c6bcddecf2c84062e415f8921d0108ac

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3388556/
  
Delivery method
Distributed via web download

Comments