MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2
SHA3-384 hash:	0c5a87adcdf5eb366b57c72cde5448c3ba169e7968f80e33b646c1c49d0dd2e0c0bba7732775382e631d7eb81eecb500
SHA1 hash:	8e4655e1e4514fc49e19d914ce0e6d482dfe2d71
MD5 hash:	bd890549b6469679c05204c8893564d9
humanhash:	hydrogen-river-maryland-mississippi
File name:	arm6
Download:	download sample
Signature	Mirai Create hunting rule
File size:	72'652 bytes
First seen:	2024-10-28 06:42:35 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:35nftoQ8au+db/4tqwI0p7Xec5vNFp3zMZibJIHdNpnI8sR:7B84p/4c4XecDJIHdNpnI
TLSH	T17963F986B881CA56C5D552BEFA1E128D331317A8D3DF7213DE106F647B8A82F0D3B952
telfhash	t194e02be6396e8dccb6f9c31080df42194aa8713aab803618ecb47b1651118c1f03b50d
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Mirai-7755770-0

Unix.Trojan.Mirai-9885259-0

Unix.Trojan.Gafgyt-9940653-0

Unix.Trojan.Mirai-10008934-0

Unix.Trojan.Gafgyt-6735924-0

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671f3296a75e41aa6722864blinux22vpnfull_triage

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/671f328b756c933fb11d5b04/reports/c426ce0c-0526-4721-b146-5e80420c4fd9/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1ffb01cc-7b57-499f-8462-cd51d458262c

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1543618

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-10-28 06:43:16 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 38 (44.74%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4u3j7fekl4jh643bjhb3urn3mximyrr5sw65uefojoscqscniora._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/241028-hgxyxstbqj/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9af9b6ca-15cc-4f71-81d2-fc2a42bad23e

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e5369f948a5f127f736149c3ba45bb65d0cc463d95bdda10ae4ba428484d43a2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.