MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86
SHA3-384 hash: 0d3af37cd1f2a46cd185f276782651f68566545d4c0e1446eb7a6e3d47bc7a4aef0b8b6dd4c83388464880a48ccc1fb7
SHA1 hash: ea78b29d0683166da777c5ba687866bd32f3f3b4
MD5 hash: 2f942e3a7e46f280f8798d9c810b9d40
humanhash: gee-london-double-lake
File name:jew.mips
Download: download sample
Signature Mirai
Create hunting rule
File size:128'536 bytes
First seen:2024-12-09 04:06:38 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:k9CY3nsXRx2+hgnSXsxVLdEgrUpziNn3Ik8LINFb1lNWYB:k9CY3nsXRx2+hrXsxVLdEgrUrWFb1lNL
TLSH T109C3725B6E208F2CF79D873146FBAD25834523A72AF5D54AD18FDA001E3071D680FAB6
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Dropper.Mirai-7135870-0
Create hunting rule

Unix.Dropper.Mirai-7135939-0
Create hunting rule

Unix.Dropper.Mirai-7136025-0
Create hunting rule

Unix.Trojan.Mirai-9964459-0
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67566cedfca9c44c2497a386linux22vpnfull_triage
Tags:
mirai
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sends data to a server
Receives data from a server
Runs as daemon
Opens a port
Substitutes an application name
Performs a bruteforce attack in the network
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug masquerade mirai
Link:
https://www.filescan.io/uploads/67566ceb333ee43ad754f23a/reports/827b9821-058c-4191-83f0-faab169cb3c7/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
5
Processes remaning?
true
Remote TCP ports scanned:
2323,23
Full report:
https://elfdigest.com/brief/d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
type:Mirai 77.111.101.78:9931
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e0dde8cb-bee6-4387-b0b3-8a7c21e8bff5
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1571168
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1571168 Sample: jew.mips.elf Startdate: 09/12/2024 Architecture: LINUX Score: 56 18 88.96.48.0 ZEN-ASZenInternet-UKGB United Kingdom 2->18 20 207.238.227.168 XO-AS15US United States 2->20 22 98 other IPs or domains 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 8 jew.mips.elf 2->8         started        signatures3 process4 process5 10 jew.mips.elf 8->10         started        12 jew.mips.elf 8->12         started        process6 14 jew.mips.elf 10->14         started        16 jew.mips.elf 10->16         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-12-08 20:24:02 UTC
File Type:
ELF32 Big (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2go7y4qjcbz7vnrloos5cj4bidmbvmdoh2jvbvdf2divvnouvsda._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:kurc defense_evasion discovery
Link:
https://tria.ge/reports/241209-epmw5szja1/
Behaviour
System Network Configuration Discovery
Changes its process name
Writes file to system bin folder
Modifies Watchdog functionality
Contacts a large (109472) amount of remote hosts
Creates a large amount of network flows
Verdict:
Malicious
Tags:
Unix.Dropper.Mirai-7135870-0
YARA:
n/a
Link:
https://app.threat.zone/submission/791e92df-43c7-4fb7-a748-47a9af7cac5f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf d19dfc72091073fab62b73a5d1278140d81ab06e3e9350d465d0d15ab5d4ac86

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3337617/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments