MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5
SHA3-384 hash:	e6442c406eea9ca6e24b52ae966ac896ac4fe69b16b812d358457e807ce386b7fff74f736d6ec5c1f2ecb3647759a2d6
SHA1 hash:	da8818a04c09611711b01a4077654136728d0d08
MD5 hash:	c3f85618d0ca2cf5079fd5a2d4b3ad90
humanhash:	neptune-arkansas-hamper-coffee
File name:	njvwa4
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	146'272 bytes
First seen:	2024-12-26 02:31:14 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:IH9LjqmPiqn0+52kctiGBuAEzML4VPYVTz+NqxR5Ak9DKyMlUfwywlucS6HhZwNk:IH9Iq0BtdBu/U4OV2NqFx59USOT2
TLSH	T10DE30941F8418B27C6D612BBFB5E428D3B2A17E8D3EE720399215F21379795B0E37642
telfhash	t1ff21e1039f044f8c37e5814c846d21169bec72ed2320a956ff697a5f56125a2f07e437
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

261

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28886.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9970440-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676cc0238a4d48ee35ff82e0linux22vpnfull_triage

Tags:

malware

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug bash lolbin remote

Link:

https://www.filescan.io/uploads/676cc0220020a55afdf1538c/reports/2df6f708-da08-4ecb-9ad9-40f7e24ded96/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

9

Number of processes launched:

2

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/755e22a8-ff36-4491-9172-d5e9aa0393d6

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1580753

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5/

ReversingLabs TitaniumCloud Linux.Backdoor.Mirai

Threat name:

Linux.Backdoor.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-26 02:32:04 UTC

File Type:

ELF32 Little (Exe)

AV detection:

22 of 38 (57.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yzmepbtedqe3mawbtiuobycbhev3vt4n7lx6y4qlppa3k66iew2q._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:botnet

Link:

https://tria.ge/reports/241226-c1ad3svnam/

Behaviour

Changes its process name

Deletes itself

Malware Config

C2 Extraction:

89.190.156.145

Threat.Zone Malicious

Verdict:

Malicious

Tags:

trojan gafgyt Unix.Trojan.Mirai-9441505-0

YARA:

Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024

Link:

https://app.threat.zone/submission/6eabef15-3676-4e16-8fd0-66b01589783e

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/c6584786641c09b602c19a28e0e041392bbacf8dfaefec720b7bc1b57bc825b5