MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments 1

SHA256 hash:	cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb
SHA3-384 hash:	73e794730082d052c6f7e058bfe9f072ab0aef0968b15a1c9c35ec409304f976d4433d54bf43e9a4fbfe3c2064f1a006
SHA1 hash:	0b63016bc34b940b5150c0f9e7aba70cd8461f0d
MD5 hash:	bdb25b48a3e25f5710404d7375ca5d48
humanhash:	equal-mexico-mexico-rugby
File name:	bdb25b48a3e25f5710404d7375ca5d48
Download:	download sample
Signature	Mirai Create hunting rule
File size:	36'016 bytes
First seen:	2024-02-11 17:44:18 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:S7v9aCKN1qksvrYWJBjprWIpP0kohP27mA2AR3U2Y:0vNgX4Y+Wi7SAlY
TLSH	T199F2D063E3A95062C8F5AC75DDAE0D0672112F7A04D776DA386D433127C9194AFF86C3
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Mirai-9894781-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug mirai packed upx

Link:

https://www.filescan.io/uploads/65c907a1bef28d0c6fb4dcbd/reports/102df40a-0acf-4d30-b6b2-09fca3546ee4/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a4071b29-c9b1-4a8f-ba85-10ae750fb9a7

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1390423

Signature

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-02-11 17:45:07 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z45s7inok5cymvgipoexipyxxjfcnkpnfac7k6clen23y4cs6xfq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet discovery upx

Link:

https://tria.ge/reports/240211-wbp8saab9s/

Behaviour

Reads runtime system information

Deletes itself

Contacts a large (76250) amount of remote hosts

Creates a large amount of network flows

Mirai

Malware Config

C2 Extraction:

scan.rebirthltd.top

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	myMirai Create hunting rule
Description:	Mirai

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research