MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed34a898f064287781c7d3aac5764dc26f8f7ba401e5bb1a42b4c0c168ea3a17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments 1

SHA256 hash:	ed34a898f064287781c7d3aac5764dc26f8f7ba401e5bb1a42b4c0c168ea3a17
SHA3-384 hash:	edc26d90b317363ebb890a468c4ab3998e704c68cae93309e850dac723e7f8294e21bd3984088cfc0710eadb2eff10e4
SHA1 hash:	f9da77b1c17d0a444ee5c21a6cb47ef3eeae1f90
MD5 hash:	67c0b57f88891c07f5f4fd6816ea993f
humanhash:	carpet-alaska-lion-hamper
File name:	67c0b57f88891c07f5f4fd6816ea993f
Download:	download sample
Signature	Mirai Create hunting rule
File size:	57'716 bytes
First seen:	2024-04-03 07:00:02 UTC
Last seen:	2024-04-03 07:27:01 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:C3zDQLBGQFtyQtWT0umSyS4Ya4gJchMD/6ffbZUYAsz6:CD0LMKMOumNDnD/mmIG
TLSH	T16543F1C4777BAB61E660043EE12B8EC2B19A42F0E169712415F58F75B1D3C0799F60CB
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

android anti-debug packed upx

Link:

https://www.filescan.io/uploads/660cfe77bb285b5db055bf87/reports/b00e2a24-3d45-4f14-98ea-5f4b5d629272/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3984007d-219e-4f99-a5fb-67de1bdeaa3f

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1419196

Signature

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Sample tries to kill multiple processes (SIGKILL)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/ed34a898f064287781c7d3aac5764dc26f8f7ba401e5bb1a42b4c0c168ea3a17

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed34a898f064287781c7d3aac5764dc26f8f7ba401e5bb1a42b4c0c168ea3a17/

Threat name:

Linux.Trojan.Svirtu

Status:

Malicious

First seen:

2024-04-02 22:17:21 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5u2krghqmquhpaoh2ovmk5snyjxy665eahs3wgscwtamc2hkhilq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

upx

Link:

https://tria.ge/reports/240403-hsmx4aac6w/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

Unexpected DNS network traffic destination

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ed34a898f064287781c7d3aac5764dc26f8f7ba401e5bb1a42b4c0c168ea3a17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_ELF_LNX_UPX_Compressed_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious ELF binary with UPX compression
Reference:	Internal Research