MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316
SHA3-384 hash: ee3df2bffb8d00acf1589a1e410d196a9de32eabb4fc5db376d7cf435d095d93e2f22fbb9d6e00a1a4bf417146473e4f
SHA1 hash: 09f4b181e0b2318b3eefe6a0b4d68db1ce2ec14b
MD5 hash: 55bf57d68bb0ce9efa3ab47f28293f33
humanhash: july-jupiter-yellow-lima
File name:55bf57d68bb0ce9efa3ab47f28293f33
Download: download sample
Signature Mirai
Create hunting rule
File size:30'548 bytes
First seen:2022-05-17 19:03:09 UTC
Last seen:2022-05-17 19:41:09 UTC
File type: elf
MIME type:application/x-executable
ssdeep 384:7ZU967KJoLosZCkXuot+dQxAZUs87YITQmdIy7hfFzSqS7CCQE+C6X3xRWGVCz0Y:lUfCLosZCHMGUsETfdIkJLrXPWvz
TLSH T1BBD2D079F5D86EC6CC997C7AD0EE86B418C27480738B4F9C1B628D85DA33C1D39C9069
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter zbetcheckin
Tags:32 elf mips mirai

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Mirai.14.5833.29408.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/6283f18736afd4ece096e787/reports/f4aa7bf1-c28d-4387-8584-17dfac39d443/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
UPX
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b56519d2-ae85-4e7d-9a8c-1ea18b2bf71d
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/996204
Signature
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 628709 Sample: AEZCIKKmr4 Startdate: 17/05/2022 Architecture: LINUX Score: 64 24 216.83.230.78 WINDSTREAMUS United States 2->24 26 130.25.151.220 VODAFONE-IT-ASNIT Italy 2->26 28 98 other IPs or domains 2->28 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Sample is packed with UPX 2->36 8 AEZCIKKmr4 2->8         started        signatures3 process4 process5 10 AEZCIKKmr4 8->10         started        12 AEZCIKKmr4 8->12         started        15 AEZCIKKmr4 8->15         started        signatures6 17 AEZCIKKmr4 10->17         started        20 AEZCIKKmr4 10->20         started        22 AEZCIKKmr4 10->22         started        38 Sample tries to kill multiple processes (SIGKILL) 12->38 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 19:04:05 UTC
File Type:
ELF32 Little (Exe)
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220517-xqxf3sagfq/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf dd4c9e9f5c1ef24d7803a5b259c166fcd7d10d0a9fe9870d601fa183bfce4316

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2199699/

Comments


Avatar
zbet commented on 2022-05-17 19:03:21 UTC

url : hxxp://85.202.169.170/webos/whoareyou.mpsl