MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments 1

SHA256 hash:	d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1
SHA3-384 hash:	740a9af4e6c0f5a0bdc126ba1230dd336ac5122ca0f4878db5a946fc0313251f028bb71dc4af6eef8d38dda3370e1783
SHA1 hash:	0cba33129a90e386fe3dc34d8e2ca0938c4dc1de
MD5 hash:	a2bb5b45c69d04bbd52eafba6f9b0a90
humanhash:	florida-speaker-zulu-texas
File name:	a2bb5b45c69d04bbd52eafba6f9b0a90
Download:	download sample
Signature	Mirai Create hunting rule
File size:	56'348 bytes
First seen:	2024-04-18 11:20:02 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:4FjKZDs8/IxOS5DUDkmXSnxV91KKfv5pux0uvKnF/2aR5S4qLu3vVJtT/9XeMIRB:4Nr5DvmixV9197/VbQurt5ob
TLSH	T1E4433B4172280543D1A25EF0353F17E1D3FBAE9231E8B248795FAB59C0B1E336546E9E
Reporter	zbetcheckin
Tags:	32 elf mirai powerpc

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Receives data from a server

Runs as daemon

Kills processes

DNS request

Opens a port

Creating a file

Sends data to a server

Connection attempt

Substitutes an application name

Performs a bruteforce attack in the network

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d76d3ed-91e9-4246-8324-71f0d9401705

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-04-17 22:00:18 UTC

File Type:

ELF32 Big (Exe)

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ax4zep6f7ymsjk4a7hzj727kqwp6555vta4it6wjm347xupfdaq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/240418-nfec3sbd87/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_Mozilla Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research