MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments 1

SHA256 hash:	ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1
SHA3-384 hash:	f0933c2cda135aa525064e35044e253fabb33127c3b9908b7c84b3f37533e9eea4d06e406eac96b16ad0422e2755a2b3
SHA1 hash:	36a930587aa22359ba02e6f1f58ffb055dae0871
MD5 hash:	1d8b2c95e60dd48f259b02c3a758df56
humanhash:	minnesota-victor-black-october
File name:	1d8b2c95e60dd48f259b02c3a758df56
Download:	download sample
Signature	Mirai Create hunting rule
File size:	53'876 bytes
First seen:	2024-04-16 02:20:38 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:xT1rkNGw57fhrbQ+xbIvHwe2fmEtHh1FnoRaD41RVkPTS:xZYPrbBu/EtHJibVW
TLSH	T196338E22F0352D78D9211AB870659975C302AEF550D31CB1DFADB6A22427FCCFA9D7A0
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 elf mirai renesas

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/88d5ad17-2b46-4b69-8030-1d9b76624cbf

Result

Threat name:

Mirai

Detection:

malicious

Classification:

troj

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1426439

Signature

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-04-15 05:41:25 UTC

File Type:

ELF32 Little (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z3mgo4w63jgmbs4rhmglzxuvo6gidybcmk45du7qct3m57xbqpqq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/240416-cs17tsgh91/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	MAL_ELF_LNX_Mirai_Oct10_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects ELF malware Mirai related
Reference:	Internal Research

Rule name:	MAL_ELF_LNX_Mirai_Oct10_2_RID2F3A Create hunting rule
Author:	Florian Roth
Description:	Detects ELF malware Mirai related
Reference:	Internal Research