MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9
SHA3-384 hash: 60b8de294ac00410a50164f477e260b24868eb53d5baebbb3980306f0b0cbf41dcdae29ff5353a85dbbc6e83341c0eb0
SHA1 hash: 8f3230b18f0056e67078262bcd2d0de9f6c949c5
MD5 hash: a5786d1ca40715070e012ba13857709b
humanhash: bravo-apart-idaho-monkey
File name:a5786d1ca40715070e012ba13857709b
Download: download sample
Signature Mirai
Create hunting rule
File size:21'884 bytes
First seen:2023-11-23 19:08:31 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5BM4uVcqgw05VxJv:9RxsSVsMD6xiJJE5zRWNM4uVcqgw095
TLSH T1E4A2D029E345AEF4DFEF9D905381C2C276F947C6268AC8E240EEAF012506042BB89D59
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 elf mirai powerpc

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-9936831-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug packed upx
Link:
https://www.filescan.io/uploads/655fa3516d3af192266f3228/reports/ad6998b5-383c-4590-8c54-be2accdbc487/overview
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/af0daf4d-8646-457d-b3ee-f965d8f80c5a
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1347082
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1347082 Sample: LSa9GUWyoj.elf Startdate: 23/11/2023 Architecture: LINUX Score: 80 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 2 other signatures 2->37 8 LSa9GUWyoj.elf 2->8         started        10 xfce4-panel wrapper-2.0 2->10         started        12 xfce4-panel wrapper-2.0 2->12         started        14 6 other processes 2->14 process3 process4 16 LSa9GUWyoj.elf 8->16         started        19 LSa9GUWyoj.elf 8->19         started        21 LSa9GUWyoj.elf 8->21         started        23 wrapper-2.0 xfpm-power-backlight-helper 10->23         started        signatures5 29 Sample tries to kill multiple processes (SIGKILL) 16->29 25 LSa9GUWyoj.elf 19->25         started        process6 process7 27 LSa9GUWyoj.elf 25->27         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2023-11-23 19:09:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wrika3p4pktrfkqz576g5thl56r3n2g7zvrr74u4xux5cxrzsc4q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
linux upx
Link:
https://tria.ge/reports/231123-xtr1rsbe79/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2734896/

Comments


Avatar
zbet commented on 2023-11-23 19:08:32 UTC

url : hxxp://93.123.85.96/hiddenbin/boatnet.ppc