MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520
SHA3-384 hash: e54503c1032dcb5855df6bada3bc0faf9ace1fd15b5baaea76662758335cc9c5ea4707a367b6ce264bc93de4d4bb0c37
SHA1 hash: 930d28ffaa3616d46e2c80a073f1a2384b930379
MD5 hash: a8f6f2c9d8bddfb5ae3c0390a0a5a26a
humanhash: harry-low-jig-one
File name:x86
Download: download sample
Signature Mirai
Create hunting rule
File size:47'232 bytes
First seen:2024-12-11 06:36:41 UTC
Last seen:2025-02-17 19:34:44 UTC
File type: elf
MIME type:application/x-executable
ssdeep 768:SugxJXBWUDM+5kc9Fo3z/L0YH2WKCPq/g0Ckb0w11z:QJRWZG/9Fo3rgYv/J0C2
TLSH T194232903BA9280BDD054D2B09A6BB037C667797E133769593398FE716F97A101E3CE48
telfhash t1d911ce712cb529a0f1e3f467ab47f9694c341a7100e036f586b1b4ebdb51f4206b0c2b
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter lontze7
Tags:elf mirai

Intelligence

File Origin
# of uploads :
11
# of downloads :
92
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ELF.Agent-AIN.9836.11499.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/675933154730808d62bd443a/reports/731d8917-347e-4fab-893c-cce740ea0e63/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8ebe6f11-75dd-4021-afe9-2d30565d7cae
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1572896
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520/
Threat name:
Linux.Backdoor.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-12-11 06:37:14 UTC
File Type:
ELF64 Little (Exe)
AV detection:
10 of 22 (45.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zduvsegdaglgn4irgaprcyz37dbi4kzxg7vyoyk2hfw5ihfh4uqa._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/241211-hdgsjawlem/
Verdict:
Malicious
Tags:
trojan mirai gafgyt
YARA:
Linux_Trojan_Gafgyt_9e9530a7 Linux_Trojan_Gafgyt_807911a2 Linux_Trojan_Gafgyt_d4227dbf Linux_Trojan_Gafgyt_620087b9 Linux_Trojan_Gafgyt_0cd591cd Linux_Trojan_Gafgyt_33b4111a Linux_Trojan_Gafgyt_a33a8363 Linux_Trojan_Mirai_6a77af0f Linux_Trojan_Mirai_e0cf29e2
Link:
https://app.threat.zone/submission/1197fa66-eac3-4c17-8131-c978fff14108
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Trojan_Gafgyt_0cd591cd
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_33b4111a
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_620087b9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_807911a2
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_9e9530a7
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_a33a8363
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d4227dbf
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_6a77af0f
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Mirai_e0cf29e2
Create hunting rule
Author:Elastic Security
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4e80dfc9443d264010a2e31891b35b5bdc4dda89caa2927474fb8af8d9ed2fe8

Mirai

elf c8e95910c3019666f111301f11633bf8c28e2b3737eb87615a396dd41ca7e520

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3344782/
  
Dropped by
SHA256 4e80dfc9443d264010a2e31891b35b5bdc4dda89caa2927474fb8af8d9ed2fe8
  
Dropped by
MD5 a6db024344aad9bcf43950021cc8dc05
  
Dropped by
SHA256 57304499209b63a0bad60438608e558439b56c91e8f58af969899cacf27b4fd7
  
Dropped by
MD5 969cf66c42c5822a7bf14d669c5e4222
  
Dropped by
SHA256 595532c371d2e08718a488d75609eba951b5e3d0a776dd9ec5bca4f959694050
  
Dropped by
MD5 876967056664b35fc685ba7f49457cca
  
Dropped by
SHA256 6a23378313cda26368c9c3fa1811ab783c65e0384e940dceebfaf43a56befafd
  
Dropped by
MD5 510af99c44ec7bbcd05479bcb0de8302
  
Dropped by
SHA256 1b6e7090a6b609378fe43afc3a2d4bb843561abb012a1f686a539aeda3d00967
  
Dropped by
MD5 dc73cf6a1a47b6d8877cdba29ff10ca2

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments