MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471
SHA3-384 hash: fd99be9d3744b4e12ed3bce0cf4a4ac4c46969c0a05f81d47153d4f4f3651d0d967c9a7acf03e9398782379d8c8353da
SHA1 hash: 6cfa60acbce51ff8bdcfa833936f3b0616ac7d41
MD5 hash: 0b6045e03773719cc0349c3fc8f0ab23
humanhash: coffee-nebraska-triple-quiet
File name:mpsl
Download: download sample
Signature Mirai
Create hunting rule
File size:79'480 bytes
First seen:2024-12-22 18:26:07 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:Yb/p29ML41JFnDamFfEZvSVuHBbS7zV5UTIfnNL2kYYA9y:Y9L4F5EZv4fnd2dY
TLSH T1BA734A84EE900F7FC02ECF30859E470645AD894A87F2A629663CCA44F69D6558FE3F5C
Magika elf
Reporter abuse_ch
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=676859f78a4d48ee35fe256alinux22vpnfull_triage
Tags:
malware
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7da28ad3-a4a7-4782-babd-69e9aa0ce928
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1579515
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-12-22 18:27:04 UTC
File Type:
ELF32 Little (Exe)
AV detection:
1 of 38 (2.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=55h4xf654lidiumihq5d5cswvjg5uu2xr7z47qpfnvdkat3dqryq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/241222-w3qzdswjcm/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fa1497f1-8f6e-4e13-bd52-da20d4494c2c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ef4fcb97dde2d03451883c3a3e8a56aa4dda53578ff3cfc1e56d46a04f638471

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3353218/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments