MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eed2ebaae31ef6e1be98ca09837d6bc7ef0ca6f84e10104368453982f26f054e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eed2ebaae31ef6e1be98ca09837d6bc7ef0ca6f84e10104368453982f26f054e
SHA3-384 hash: 1ecd2709eb2dd61c90cdac652e068938173e95e9e9e14534087a0d778aa64c03c3471e23fe1bacd38bd1a2de9b4506cd
SHA1 hash: 8a0647c7a6dc8c83f5f2660989a6013a52f68e9b
MD5 hash: ff8a7537f51edbe2fc451185bb8f9f50
humanhash: nebraska-quiet-pizza-equal
File name:ff8a7537f51edbe2fc451185bb8f9f50
Download: download sample
Signature Mirai
Create hunting rule
File size:54'608 bytes
First seen:2022-04-10 23:02:10 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:Lre+yqedFog6cFGZXRiWblhDOg62ZnKnuBWe7x0EpiSgNJTP1Kw/8yUfY:v/yHdxeEgP1KuBpt0ciSgNJL1KG87fY
TLSH T10D331896B800AD2CFD4AE6BA81164F0CF5307B3450634777A6B2FC9B5D723A49D1AF81
Reporter zbetcheckin
Tags:32 elf mirai motorola

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-6981989-0
Create hunting rule

Unix.Dropper.Mirai-7135828-0
Create hunting rule

Unix.Dropper.Mirai-7135872-0
Create hunting rule

Unix.Dropper.Mirai-7135893-0
Create hunting rule

Unix.Dropper.Mirai-7135900-0
Create hunting rule

Unix.Dropper.Mirai-7135934-0
Create hunting rule

Unix.Dropper.Mirai-7135951-0
Create hunting rule

Unix.Dropper.Mirai-7136105-0
Create hunting rule

Unix.Trojan.Mirai-7759336-0
Create hunting rule

Unix.Trojan.Mirai-9885259-0
Create hunting rule

Unix.Trojan.Mirai-9885284-0
Create hunting rule

Unix.Trojan.Mirai-9940650-0
Create hunting rule

Unix.Trojan.Gafgyt-6735924-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug mirai
Link:
https://www.filescan.io/uploads/625362270d7cd5530a7da6ec/reports/403d918f-fedd-4576-bcbf-9353d2a16bb7/overview
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/72d10e09-36fa-402b-8e8e-9c7d6ff5360d
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/974142
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses known network protocols on non-standard ports
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 606629 Sample: 3JXOdzTr76 Startdate: 11/04/2022 Architecture: LINUX Score: 68 42 156.92.15.90 WAL-MARTUS United States 2->42 44 171.244.41.98 VTDC-AS-VNVietel-CHTCompamyLtdVN Viet Nam 2->44 46 98 other IPs or domains 2->46 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Mirai 2->52 54 Uses known network protocols on non-standard ports 2->54 10 systemd fstrim 3JXOdzTr76 2->10         started        signatures3 process4 process5 12 3JXOdzTr76 10->12         started        14 3JXOdzTr76 10->14         started        16 3JXOdzTr76 10->16         started        process6 18 3JXOdzTr76 12->18         started        20 3JXOdzTr76 12->20         started        22 3JXOdzTr76 14->22         started        24 3JXOdzTr76 14->24         started        26 3JXOdzTr76 14->26         started        process7 28 3JXOdzTr76 18->28         started        30 3JXOdzTr76 18->30         started        32 3JXOdzTr76 18->32         started        34 3JXOdzTr76 22->34         started        36 3JXOdzTr76 22->36         started        process8 38 3JXOdzTr76 28->38         started        40 3JXOdzTr76 28->40         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eed2ebaae31ef6e1be98ca09837d6bc7ef0ca6f84e10104368453982f26f054e/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-04-10 23:03:05 UTC
File Type:
ELF32 Big (Exe)
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220410-21nn5sdgfm/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.23
Link:
https://yomi.yoroi.company/submissions/eed2ebaae31ef6e1be98ca09837d6bc7ef0ca6f84e10104368453982f26f054e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf eed2ebaae31ef6e1be98ca09837d6bc7ef0ca6f84e10104368453982f26f054e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2140543/

Comments


Avatar
zbet commented on 2022-04-10 23:02:16 UTC

url : hxxp://192.210.132.120/bins/HEETS.m68k