MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746
SHA3-384 hash: 6e3ec3f51c63c77e2dd9f56e9493bbc3fd68b4eb8db5721e6bb7257729989e8925adb66e349d55ade9b03bb6b1409808
SHA1 hash: 87c0098d9c86435194231c2f5623a7e8c488a861
MD5 hash: 73b136cb342e7a64855905830cdf0c0b
humanhash: ohio-batman-avocado-may
File name:73b136cb342e7a64855905830cdf0c0b
Download: download sample
Signature Mirai
Create hunting rule
File size:46'656 bytes
First seen:2024-04-24 08:57:00 UTC
Last seen:2024-04-24 09:34:38 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:cnhQn2SuI+h7gjER7R3Q2stXIhyXkGhe0WDo31aostZwceD6hnTKcb4uVcqgw0Eo:XNO6Qc2UXIoX1e0J31fstZwyN3b4u+qc
TLSH T1FE23F13ADD692D3AFC6FFD323D5A8363A72ED68515A3A3950184FF414C4D02AED848C4
Reporter zbetcheckin
Tags:32 elf mirai powerpc

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
FR FR
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Receives data from a server
Runs as daemon
Kills processes
Opens a port
Sends data to a server
Connection attempt
Substitutes an application name
Kills critical processes
Deleting of the original file
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ed3f0ab0-073c-4c06-a73b-6f253e14341d
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1430906
Signature
Multi AV Scanner detection for submitted file
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430906 Sample: XHYKEGTtfq.elf Startdate: 24/04/2024 Architecture: LINUX Score: 60 42 212.70.149.14, 35342, 42674, 42678 INTERNET-HOSTINGBG Bulgaria 2->42 44 Multi AV Scanner detection for submitted file 2->44 8 XHYKEGTtfq.elf 2->8         started        11 gvfsd-fuse fusermount 2->11         started        13 systemd gpu-manager 2->13         started        15 31 other processes 2->15 signatures3 process4 signatures5 46 Sample deletes itself 8->46 17 XHYKEGTtfq.elf 8->17         started        48 Sample reads /proc/mounts (often used for finding a writable filesystem) 11->48 19 gpu-manager sh 13->19         started        21 gpu-manager sh 15->21         started        23 generate-config pkill 15->23         started        25 generate-config pkill 15->25         started        27 3 other processes 15->27 process6 process7 29 XHYKEGTtfq.elf 17->29         started        32 XHYKEGTtfq.elf 17->32         started        34 XHYKEGTtfq.elf 17->34         started        36 XHYKEGTtfq.elf 17->36         started        38 sh grep 19->38         started        40 sh grep 21->40         started        signatures8 50 Sample tries to kill multiple processes (SIGKILL) 29->50
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-04-24 08:57:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zbqnbap3rt7nfdibwbkl6fqrykk2nuyhkn2whlicmugmstbia5da._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/240424-kwlwbagb89/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:upx_antiunpack_elf32
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:UPX Anti-Unpacking technique to magic renamed for ELF32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2824994/

Comments


Avatar
zbet commented on 2024-04-24 08:57:01 UTC

url : hxxp://212.70.149.14/powerpc