MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad
SHA3-384 hash:	77cab1b556478f9d3c9da016a7c5bf9372493645cb7640439a70d7556f48ca8de40c24d64cbbe2955495504ae153fa15
SHA1 hash:	cca862eb7f798b357899381c1318b01f969767c9
MD5 hash:	1739477fc060ab3d7bc79785d4739d77
humanhash:	edward-stream-montana-lima
File name:	bot.x86_64-20231216-0602
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	143'832 bytes
First seen:	2023-12-16 06:02:49 UTC
Last seen:	2023-12-16 06:03:38 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:mTUTfCdO6FFtoqh6EwKhc/t/ekNaogMewcgsK027uLOlI:mTUTfCdO6FFtoq6wwQdcI
TLSH	T156E34A07B4C184FDC4DAC1B44B9FF53AED32B0AD1238B16B27D4AA222E59E215F1DA54
telfhash	t1785132b438253994b2fbba3ab30af991ac71095419e131d1dd73b8e2de167c40e72832
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	elfdigest
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

106

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28940.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28880.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7540662-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9441505-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9945193-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9946826-0

Alert

Create hunting rule

Unix.Dropper.Mirai-10008433-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011027-0

Alert

Create hunting rule

Unix.Trojan.Mirai-10011918-0

Alert

Create hunting rule

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug lolbin mirai remote

Link:

https://www.filescan.io/uploads/657d3d9bb4e856b7281b9958/reports/0af3260d-b288-43b7-9dd9-89e5ad1dd736/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

103.77.240.57

Number of open files:

47

Number of processes launched:

3

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

type:Moobot 103.77.240.57:43957

UDP botnet C2(s):

not identified

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5b9e369f-5407-43a1-8305-52cb914ba219

Joe Sandbox Mirai

Result

Threat name:

Mirai

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363258

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Detected Mirai

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 06:03:07 UTC

File Type:

ELF64 Little (Exe)

AV detection:

19 of 23 (82.61%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5wirss7w2agt7hqzvw5gg3pfvyaqg6nm3lyjn6kheytmgy4bwkwq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

linux

Link:

https://tria.ge/reports/231216-gr1xwsafdp/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/ed91194bf6d00d3f9e19adba636de5ae010379acdaf096f9472626c36381b2ad