MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95
SHA3-384 hash:	6037629512c99a68fc23499b31c0b3ba9b4ed9ea8fd64c9b3dcef6382ee077eda31384196a9d9fa86f6391f248b7a2df
SHA1 hash:	1fa4ab9bfb5972aae835974275c3e0f651ae29d9
MD5 hash:	1a50ccb5387b53a4bfae8657ae9446c2
humanhash:	solar-quiet-blossom-earth
File name:	nabarm5
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	40'024 bytes
First seen:	2024-11-28 07:21:25 UTC
Last seen:	2024-12-08 14:44:15 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:xaW4dpSrQoeV7Q2Jb1c9313U6QNLZW3I9ElSQnNGt6f4T3bsRQ:B8+KaF3sZW0l2Ge4T3bsRQ
TLSH	T19D03E78AB891CA16C5D591B7FB4E82DC372613A8D1EF7303DD15AF693A4782B0E3B540
telfhash	t11a21ac584ec196be8350447ed19bb765f2417876bec31c2585bd9d0b53329d36832c2a
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

128

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

Unix.Trojan.Mirai-7755770-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9885259-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10008934-0

Alert

Create hunting rule

Unix.Trojan.Gafgyt-6735924-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67481bd7b31374f09835591dlinux22vpnfull_triage

Tags:

malware

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/67481a1d1e77db75f649865f/reports/c51c9c9a-4554-4658-ac6a-5f984e7da3df/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

90

Number of processes launched:

4

Processes remaning?

true

Remote TCP ports scanned:

23

Full report:

https://elfdigest.com/brief/d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95

Behaviour

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aa4738be-54d6-48a2-aff8-40af4a6c96ed

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1564344

Signature

Connects to many ports of the same IP (likely port scanning)

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95/

ReversingLabs TitaniumCloud Linux.Backdoor.Mirai

Threat name:

Linux.Backdoor.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-28 07:22:10 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zdhubaz66wwg47plx5wd5z6exjdg4rp7jsbcjbllmgdkowmdwkq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/241128-h68fyszna1/

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-7755770-0

YARA:

n/a

Link:

https://app.threat.zone/submission/86e3e13d-e8ae-402a-844e-f54e1eb7e1a9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d6467a0419f7ad6373ef5dfb61f73e25d233722ffa6411242b5b0c353acc1d95