MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777
SHA3-384 hash: c9d422a3dac8ed606a98a4dfa5df6de95fc14fb27ae57a1fa6a7fd14e7c95956bdb2411f64caa1a62beed470b6111e56
SHA1 hash: 53c9667c864f5dbf3bcce87e1ea4582c596e0d79
MD5 hash: 8bec858fb2ad735ce7dcb1ff009bbb90
humanhash: two-jupiter-twenty-solar
File name:Mozi.m
Download: download sample
File size:307'960 bytes
First seen:2021-07-16 03:01:48 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio/Q33Q:p3lOYoaja8xzx/0wsxzSiqJ
TLSH T1A2640287FB11BC1BCA010BB125DB0B9977BCDA5B82CBD091B7D0885F39BA185B7A11C5
Reporter tolisec

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai-63.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-29.UNOFFICIAL
Create hunting rule

Unix.Dropper.Botnet-6566040-0
Create hunting rule

Unix.Packed.Botnet-6566031-0
Create hunting rule

Unix.Trojan.Gafgyt-6748839-0
Create hunting rule

Unix.Trojan.Mozi-9840825-0
Create hunting rule

Unix.Trojan.Mirai-9843255-0
Create hunting rule

Verdict:
Malicious
Uses P2P?:
true
Uses anti-vm?:
false
Architecture:
mips
Packer:
UPX
Botnet:
117.222.164.30:49937
Number of open files:
427
Number of processes launched:
38
Processes remaning?
true
Remote TCP ports scanned:
52869,8080,80,7574,8081,49152,5555,8181,81,8443,37215,60001,2323,23
Full report:
https://elfdigest.com/brief/c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777
Behaviour
Process Renaming
Firewall Changes
Information Gathering
Botnet C2s
TCP botnet C2(s):
212.129.33.59:6881
82.221.103.244:6881
130.239.18.159:6881
87.98.162.88:6881
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc52d964-bd4c-44c2-93b8-b4b4b2f604dc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777/
Threat name:
Linux.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2021-07-16 02:47:13 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
linux
Link:
https://tria.ge/reports/210716-15aj2mpgvx/
Behaviour
Reads runtime system information
Writes file to tmp directory
Reads system network configuration
Enumerates active TCP sockets
Reads system routing table
Modifies hosts file
Modifies the Watchdog daemon
Writes file to system bin folder
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

elf c5184d125d847cc38ecc5e26454c035e94eab9262d1de2d06ea853e29bd28777

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1458043/
  
Delivery method
Distributed via web download

Comments