MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f
SHA3-384 hash: 2257e9592be04eddc9a4b67a0d20159da2c986fccdbb2ffa46c1e3fa82307287814c0a82432d4efe662c1b41f9389c89
SHA1 hash: 77fc47b8ca7da86948db4c9dd775a96fbebef9b1
MD5 hash: df9c7684434eb59a99b71a3a8ee01099
humanhash: michigan-apart-arkansas-march
File name:df9c7684434eb59a99b71a3a8ee01099
Download: download sample
Signature Mirai
Create hunting rule
File size:92'512 bytes
First seen:2022-04-10 10:27:02 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:a5DnSB+v5gjQm2I17xk49d6xZLu8vJ4TGo8S:a5TSB+v5gjQmN1GFrvhrS
TLSH T1E393A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74
Reporter zbetcheckin
Tags:32 elf mips mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Dropper.Mirai-7136015-0
Create hunting rule

Unix.Trojan.Mirai-9876194-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug remote.exe
Link:
https://www.filescan.io/uploads/6252b1320d7cd5530a7a4802/reports/a485efb3-d30b-48ba-a1f4-b916ff995a85/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
not packed
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3de8bf83-b4d8-4fb1-9f56-380b880625e1
Result
Threat name:
Mirai
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/974003
Signature
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 606490 Sample: QiajAvPmm3 Startdate: 10/04/2022 Architecture: LINUX Score: 72 18 5.17.173.31 ZTELECOM-ASRU Russian Federation 2->18 20 13.9.19.33 XEROX-WVUS United States 2->20 22 98 other IPs or domains 2->22 24 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Mirai 2->28 8 QiajAvPmm3 2->8         started        signatures3 process4 process5 10 QiajAvPmm3 8->10         started        process6 12 QiajAvPmm3 10->12         started        14 QiajAvPmm3 10->14         started        16 QiajAvPmm3 10->16         started       
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2022-04-10 10:28:04 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220410-mg5e8ahefn/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf f10366d97c5c0bef189670dedf650995a9438f40055aef9c7cc3ce11de2e0c1f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2139837/

Comments


Avatar
zbet commented on 2022-04-10 10:27:06 UTC

url : hxxp://2.56.59.37/bins/mpsl