MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11
SHA3-384 hash: 38393e720475ab95890abba905815c74dc083922ac86669d5ac079ccf737f32d39519d4340cdbecc9d6457afe96f2bf4
SHA1 hash: badf21c128b27dd8019da6b467adc77f1082903f
MD5 hash: f52dfbd112ab4b3f82cd08b7f79889b0
humanhash: april-dakota-beer-ack
File name:SecuriteInfo.com.Trojan.Linux.Agent.HIT.11949.5550
Download: download sample
Signature Mirai
Create hunting rule
File size:37'648 bytes
First seen:2022-04-16 03:35:49 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpb:XtBTX941eYF8NblpuvnwF
TLSH T1B5F202882E03858BC533257E754B995679C70F5A301F496C21FAE1298BF331CBBB5315
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter SecuriteInfoCom
Tags:elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Linux.Agent.HIT.11949.5550.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug mirai
Link:
https://www.filescan.io/uploads/625a39a2ffe27d5119e22b8a/reports/b0c00f3e-476b-45ea-8026-e6a5a91588d8/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
UPX
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bf8a7709-7024-43b9-aa40-99dc1301f404
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/977594
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11/
Threat name:
Linux.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2020-10-24 16:07:53 UTC
File Type:
ELF32 Little (Exe)
AV detection:
16 of 42 (38.10%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
linux
Link:
https://tria.ge/reports/220416-d5w93sgggl/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf f1fb35f410ec3101d1edf2396235a9262e41370cfb0875c13553edb7a89a1f11

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/783059/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1434299/
  
URLhaus
https://urlhaus.abuse.ch/url/2017523/

Comments