MALICIOUS — 6aa15a6d3106b29f9158a11c6a6703a41bc5527700712f625175714f6946ddf4
MALICIOUS — 6aa15a6d3106b29f9158a11c6a6703a41bc5527700712f625175714f6946ddf4 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mirai family. 8 of 57 detection engines flagged it.
Identification
- SHA-256:
6aa15a6d3106b29f9158a11c6a6703a41bc5527700712f625175714f6946ddf4 - SHA-1:
ea6683e679d6da3517e1e93c37252a9c080885e5 - MD5:
ba1951098b34d2b13fc2e01d190e5032 - ssdeep:
6144:7O/QJHZweEL/NOjCHm7FZZncuoNsKqqfPqOJ:78QpZsKCaiuHKqoPqOJ - TLSH:
T19546F105916B2886D8F44EC54CA04CEFA7CF954E6C3ACDDD8A860AB7444D7B308B81E7 - Submitted as: 6aa15a6d3106b29f9158a11c6a6703a41bc5527700712f625175714f6946ddf4
- File type: elf · Size: 296800 bytes
- Verdict: malicious (100/100) · Family: Mirai
Detections (8 of 57 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX 3.95
- ClamAV (daily): Unix.Trojan.Mirai-7100807-0
- YARA: Intezer community: INTEZER_ELF_UPX_Modified
- YARA: Stratosphere IPS: STRATO_Mirai_Botnet
- Detect It Easy (packer/type): DIE:UPX 3.95
- Microsoft Defender: Trojan:Linux/Dakkatoni.A!MTB
- Emsisoft (Emergency Kit): Trojan.Linux.Mozi.6
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.r
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-7100807-0 (rule
Unix.Trojan.Mirai-7100807-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 4 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in dropbear (pid 701) (rule
linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - YARA: Stratosphere IPS flagged STRATO_Mirai_Botnet (rule
STRATO_Mirai_Botnet) - engine signal, weight 0.70, confidence 0.70 - Microsoft Defender flagged Trojan:Linux/Dakkatoni.A!MTB (rule
Trojan:Linux/Dakkatoni.A!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Mozi.6 (rule
Trojan.Linux.Mozi.6) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.r (rule
HEUR:Backdoor.Linux.Mirai.r) - engine signal, weight 0.55, confidence 0.85 - YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule
INTEZER_ELF_UPX_Modified) - engine signal, weight 0.40, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX 3.95 (rule
DIE:UPX 3.95) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX 3.95 (rule
UPX 3.95) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://upx.sf.net, http://ipinfo.io/ip, http://127.0.0.1 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX 3.95 - static signal, weight 0.25, confidence 0.55
- Contacted 978 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. injected region in dropbear (pid 781) (rule
linux.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (linux)
871 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep
- dht.transmissionbt.com
- router.bittorrent.com
- router.utorrent.com
- ntp.ubuntu.com
- bttracker.debian.org
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- www.aamailsoft.com
- 85.210.196.11
- 224.0.0.251
- ff02::fb
- ff02::1:3
- 224.0.0.252
- 188.223.75.92
- 215.12.8.162
- 20.105.253.71
Dropped files
- tmp_.config -
74c9b3a712c3e883f3d0181d64bb83d4aa02f1619615f4f584441e4ae4de0936 - tmp_.ips -
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Embedded URLs
- http://upx.sf.net
- http://ipinfo.io/ip
- http://127.0.0.1
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://schemas.xmlsoap.org/soap/envelope//
- http://purenetworks.com/HNAP1/
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
Embedded domains
- upx.sf.net
- baidu.com
- ipinfo.io
- wifi.sh
- dht.transmissionbt.com
- router.bittorrent.com
- router.utorrent.com
- bttracker.debian.org
- bin.sh
- bix.sh
- schemas.xmlsoap.org
- purenetworks.com
- www.w3.org
- www.aamailsoft.com
Embedded IP addresses
- 8.8.8.8
- 114.114.114.114
- 212.129.33.59
- 82.221.103.244
- 130.239.18.159
- 87.98.162.88
- 239.255.255.250
- 192.168.0.100
- 192.168.1.1
- 192.168.3.1
- 85.210.196.11
- 188.223.75.92
- 215.12.8.162
- 20.105.253.71
- 73.2.105.137
- 89.108.217.242
- 32.53.117.94
- 138.253.59.82
- 124.45.95.154
- 117.124.125.27
- 69.223.172.82
- 211.101.165.94
- 96.141.53.199
- 53.124.130.30
- 96.200.115.23
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report