MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653
SHA3-384 hash:	0eaf00ef4175a0a04b33ec3b346f4a92b7d107655914a549f51e4b67f9c2768c3da1f6de70ad52dff3610fc0c536ed11
SHA1 hash:	d543d237c89b520480c67428a452581bc89dfcb0
MD5 hash:	9dfe172805fa56458279246542460acb
humanhash:	moon-carbon-blossom-bakerloo
File name:	9dfe172805fa56458279246542460acb
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	24'912 bytes
First seen:	2023-08-22 21:10:26 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:okrQlS07dEv0UXqUhvQE+CXQKMQKCXBp+LZqsWv4:ZQlS07FUXqIYSXQKqu+NqS
TLSH	T1A4B2D0CC61943484CA8D7C7C678D4A664F6CA1D0BAEDCB16E350CDD8B3BDA8B3459078
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 elf mips mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

102

Origin country :

FR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-9955504-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9955732-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9956143-0

Alert

Create hunting rule

FileScan.io

Gathering data

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

UPX

Botnet:

unknown

Number of open files:

7

Number of processes launched:

1

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d542a421-55b9-41ed-b74f-a054587e8004

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1295528

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Sample tries to kill multiple processes (SIGKILL)

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653/

ReversingLabs TitaniumCloud Linux.Trojan.Multiverze

Threat name:

Linux.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-08-22 21:11:08 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 23 (65.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=43meghyfyto62le6o73ma4bgxjjcbj45i63slcu6kyxp4ywo6zjq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:lzrd botnet upx

Link:

https://tria.ge/reports/230822-z1kw5sfd89/

Behaviour

Writes file to system bin folder

Modifies Watchdog functionality

Mirai

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-08-22 21:10:27 UTC

url : hxxp://45.15.158.128/hiddenbin/boatnet.mpsl