MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f
SHA3-384 hash: 152e3d928a52947343055ed966cacce57dd0fc7bc0908b7e5ad750aa53f31b79698552725664bebd916dd1dcd923feb4
SHA1 hash: 75144ce8fa5774ec2e438fcab162360e6535d296
MD5 hash: b9b807269e42f7dfe7a06695ff7235b6
humanhash: georgia-one-eighteen-arizona
File name:b9b807269e42f7dfe7a06695ff7235b6
Download: download sample
Signature Mirai
Create hunting rule
File size:63'112 bytes
First seen:2024-01-30 14:02:24 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:8txlH4RsYEqRcqERkrL6pGyIus2CH9BZdwoosUsaJBoEHNE/NF5otfKyDIdA2:8MrEc69XmBvwohU7oSS/ZolpwA2
TLSH T1B2534B02721C0E47C1B35A743A3F27E083BFEA9121E4F684651F9B869675E3A5186FCD
Reporter zbetcheckin
Tags:32 elf mirai powerpc

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-9801524-0
Create hunting rule

Unix.Trojan.Mirai-10001386-0
Create hunting rule

Unix.Trojan.Mirai-10010127-0
Create hunting rule

Unix.Trojan.Mirai-10017351-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug lolbin remote
Link:
https://www.filescan.io/uploads/65b9019f814c2aeb14853c32/reports/fbd94ff8-018a-440a-afd6-4da5903ce7b9/overview
Result
Verdict:
MALICIOUS
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7e4dfff0-7379-4769-8822-7901169061bc
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1383326
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1383326 Sample: AKcf7952rJ.elf Startdate: 30/01/2024 Architecture: LINUX Score: 48 14 45.154.1.144, 1488, 42446, 42448 KEVIN-SCHMITZDE Russian Federation 2->14 16 Multi AV Scanner detection for submitted file 2->16 7 AKcf7952rJ.elf 2->7         started        signatures3 process4 file5 12 /tmp/tempUX1CXf, ELF 7->12 dropped 10 AKcf7952rJ.elf 7->10         started        process6
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2024-01-30 14:03:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76x6qg6ke2ejiqclt5goned7owxkjl4daxpyqsgrnzqgwh62kyxq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:mirai linux
Link:
https://tria.ge/reports/240130-rcpanahgel/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:myMirai
Create hunting rule
Description:Mirai
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

elf ffafe81bca268894404b9f4ce6907f75aea4af8305df8848d16e606b1fda562f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2753581/

Comments


Avatar
zbet commented on 2024-01-30 14:02:24 UTC

url : hxxp://45.154.1.144/bins/VRppc