MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8b47fb100d7efff202af48ce7c944f384ffdd2452d716a08cde58d4f10119f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d8b47fb100d7efff202af48ce7c944f384ffdd2452d716a08cde58d4f10119f6
SHA3-384 hash:	4d780eba269c164bcdc6dcb52ce27157fbdb2f2d32e16326bd20299c989df77264f284e65cd68f4d31b07b1ecfa1000c
SHA1 hash:	3d7353377453103f389fe294f223587ea1104271
MD5 hash:	724c7bb7524b5eebba6ba298f97aeeb6
humanhash:	ink-venus-pluto-september
File name:	724c7bb7524b5eebba6ba298f97aeeb6
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	18'476 bytes
First seen:	2023-07-27 00:16:04 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	384:OiZ+2wmDcpRvKKTTAd/zkb8eicBsEXD28FBboxhymdGUop5htPl:OiZ+2wmDcpVjAdA/ic+EXDzixs3UozL9
TLSH	T1FC82D026C0E4E970C9704835AFBC4B8323871BB5D5FBB1732A00967CE5A355791B838B
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf gafgyt mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

108

Origin country :

FR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-8274771-0

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/64c1b77e6635e735db25dbd9/reports/5c32ac95-bdae-4f1e-888e-50d04b4d651d/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

UPX

Botnet:

unknown

Number of open files:

0

Number of processes launched:

0

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/d8b47fb100d7efff202af48ce7c944f384ffdd2452d716a08cde58d4f10119f6

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a525623a-716d-45e1-84d4-c769dde62c9e

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1280761

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d8b47fb100d7efff202af48ce7c944f384ffdd2452d716a08cde58d4f10119f6/

ReversingLabs TitaniumCloud Linux.Trojan.Gafgyt

Threat name:

Linux.Trojan.Gafgyt

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-27 00:17:04 UTC

File Type:

ELF32 Little (Exe)

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3c2h7mia27x76ibk6sgopske6ocp7xjekllrniem3zmnj4ibdh3a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

upx

Link:

https://tria.ge/reports/230727-ak2saage96/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d8b47fb100d7efff202af48ce7c944f384ffdd2452d716a08cde58d4f10119f6

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-07-27 00:16:05 UTC

url : hxxp://57.128.87.13/hiddenbin/m1sc.arm5