mirai | leviathan[.]arm7[.]elf

General

Target
leviathan.arm7.elf
Size 182KB
Sample261024-mch2eshs51
SHA256 7bf253e88bbded37d52cb3fd627dcbcd69b570a45e2b3fdda7c2fff168cde408
MD5 47c41f150e9f723356cead8d5ba1e271
SHA1 621fff6664321cd2d6d41ba33413278aeece1f91
SHA512 2dd77f7da51b5edf42ace3fac1cd2795753038feaf4df8eec2e95203fb2e300c16250b09de675b34e35a484eac695dca841f75579856e59ccde2f388e0572458
SSDEEP 3072:oTnv+8u5lKB6aHRSVFSaT9df0N9d1Z5hDxHRcnM/9UAFmDwacZuMp5n:CHu54B6aHRSVFhTo9dT5hDxHRoM/9Uk5
TLSH
T1ED043C16F6518A43C0C61B76BADF520533339BB8E3D773069918AFB43F8275A0E27946
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet mirai gafgyt

Family

C2

Family: Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Detected Gafgyt variant 1 IoCs

resource	yara_rule
sample	family_gafgyt

Mirai ARM payload 1 IoCs

resource	yara_rule
sample	family_mirai_arm

SHA256 7bf253e88bbded37d52cb3fd627dcbcd69b570a45e2b3fdda7c2fff168cde408
MD5 47c41f150e9f723356cead8d5ba1e271
SHA1 621fff6664321cd2d6d41ba33413278aeece1f91
SHA512 2dd77f7da51b5edf42ace3fac1cd2795753038feaf4df8eec2e95203fb2e300c16250b09de675b34e35a484eac695dca841f75579856e59ccde2f388e0572458
SSDEEP 3072:oTnv+8u5lKB6aHRSVFSaT9df0N9d1Z5hDxHRcnM/9UAFmDwacZuMp5n:CHu54B6aHRSVFhTo9dT5hDxHRoM/9Uk5
TLSH
T1ED043C16F6518A43C0C61B76BADF520533339BB8E3D773069918AFB43F8275A0E27946
MD5 SHA1 SHA512 SSDEEP TLSH

linux arm