SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.mirai (Back to overview)

Mirai

aka: Katana
URLhaus        

Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.

References
2021-04-15UptycsSiddharth Sharma
@online{sharma:20210415:mirai:9db8c55, author = {Siddharth Sharma}, title = {{Mirai code re-use in Gafgyt}}, date = {2021-04-15}, organization = {Uptycs}, url = {https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt}, language = {English}, urldate = {2021-04-19} } Mirai code re-use in Gafgyt
Bashlite Mirai
2021-03-21BlackberryBlackberry Research
@techreport{research:20210321:2021:a393473, author = {Blackberry Research}, title = {{2021 Threat Report}}, date = {2021-03-21}, institution = {Blackberry}, url = {https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf}, language = {English}, urldate = {2021-03-25} } 2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2021-03-15Palo Alto Networks Unit 42Vaibhav Singhal, Ruchna Nigam, Zhibin Zhang, Asher Davila
@online{singhal:20210315:new:d276fac, author = {Vaibhav Singhal and Ruchna Nigam and Zhibin Zhang and Asher Davila}, title = {{New Mirai Variant Targeting New IoT Vulnerabilities, Including in Network Security Devices}}, date = {2021-03-15}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/}, language = {English}, urldate = {2021-03-22} } New Mirai Variant Targeting New IoT Vulnerabilities, Including in Network Security Devices
Mirai
2020-12-03360 netlabYanlong Ma, GenShen Ye
@online{ma:20201203:another:bb8fa99, author = {Yanlong Ma and GenShen Ye}, title = {{Another LILIN DVR 0-day being used to spread Mirai}}, date = {2020-12-03}, organization = {360 netlab}, url = {https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/}, language = {English}, urldate = {2020-12-08} } Another LILIN DVR 0-day being used to spread Mirai
Mirai
2020-10-20AviraAvira Protection Labs
@online{labs:20201020:katana:4dc0a7b, author = {Avira Protection Labs}, title = {{Katana: a new variant of the Mirai botnet}}, date = {2020-10-20}, organization = {Avira}, url = {https://prod-blog.avira.com/katana-a-new-variant-of-the-mirai-botnet}, language = {English}, urldate = {2020-10-23} } Katana: a new variant of the Mirai botnet
Mirai
2020-10-14Palo Alto Networks Unit 42Ken Hsu, Yue Guan, Vaibhav Singhal, Qi Deng
@online{hsu:20201014:two:aa1efb9, author = {Ken Hsu and Yue Guan and Vaibhav Singhal and Qi Deng}, title = {{Two New IoT Vulnerabilities Identified with Mirai Payloads}}, date = {2020-10-14}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/}, language = {English}, urldate = {2020-10-23} } Two New IoT Vulnerabilities Identified with Mirai Payloads
Mirai
2020-07-28Trend MicroFernando Mercês
@online{mercs:20200728:mirai:3538243, author = {Fernando Mercês}, title = {{Mirai Botnet Exploit Weaponized to Attack IoT Devices via CVE-2020-5902}}, date = {2020-07-28}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/}, language = {English}, urldate = {2020-07-30} } Mirai Botnet Exploit Weaponized to Attack IoT Devices via CVE-2020-5902
Mirai
2020-07-08Trend MicroTrend Micro
@online{micro:20200708:new:ee4cbf8, author = {Trend Micro}, title = {{New Mirai Variant Expands Arsenal, Exploits CVE-2020-10173}}, date = {2020-07-08}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/new-mirai-variant-expands-arsenal-exploits-cve-2020-10173/}, language = {English}, urldate = {2020-07-13} } New Mirai Variant Expands Arsenal, Exploits CVE-2020-10173
Mirai
2020-05-14paloalto Networks Unit 42Ruchna Nigam
@online{nigam:20200514:mirai:65d9d83, author = {Ruchna Nigam}, title = {{Mirai and Hoaxcalls Botnets Target Legacy Symantec Web Gateways}}, date = {2020-05-14}, organization = {paloalto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/}, language = {English}, urldate = {2020-05-18} } Mirai and Hoaxcalls Botnets Target Legacy Symantec Web Gateways
Bashlite Mirai
2020-02-24The MalwareMustDie Blogunixfreakjp
@online{unixfreakjp:20200224:mmd00662020:0620daf, author = {unixfreakjp}, title = {{MMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat}}, date = {2020-02-24}, organization = {The MalwareMustDie Blog}, url = {https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html}, language = {English}, urldate = {2020-02-27} } MMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat
FBot Mirai
2019-10-02Politie NLPolitie NL
@online{nl:20191002:servers:08fffed, author = {Politie NL}, title = {{Servers botnet offline}}, date = {2019-10-02}, organization = {Politie NL}, url = {https://www.politie.nl/nieuws/2019/oktober/2/11-servers-botnet-offline.html}, language = {English}, urldate = {2020-01-08} } Servers botnet offline
Mirai
2019-09-10ReversingLabsJosip Milić
@online{mili:20190910:mirai:906e0a9, author = {Josip Milić}, title = {{Mirai Botnet Continues to Plague IoT Space}}, date = {2019-09-10}, organization = {ReversingLabs}, url = {https://blog.reversinglabs.com/blog/mirai-botnet-continues-to-plague-iot-space}, language = {English}, urldate = {2020-01-13} } Mirai Botnet Continues to Plague IoT Space
Mirai
2019-06-06Palo Alto Networks Unit 42Ruchna Nigam
@online{nigam:20190606:new:916134e, author = {Ruchna Nigam}, title = {{New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices}}, date = {2019-06-06}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/}, language = {English}, urldate = {2020-03-09} } New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices
Echobot Mirai
2019-04-12Stratosphere LabMaría José Erquiaga
@online{erquiaga:20190412:analysis:bb76a6f, author = {María José Erquiaga}, title = {{Analysis of an IRC based Botnet}}, date = {2019-04-12}, organization = {Stratosphere Lab}, url = {https://www.stratosphereips.org/blog/2019/4/12/analysis-of-a-irc-based-botnet}, language = {English}, urldate = {2020-01-10} } Analysis of an IRC based Botnet
Mirai
2019-04-08Palo Alto Networks Unit 42Ruchna Nigam
@online{nigam:20190408:mirai:b25b562, author = {Ruchna Nigam}, title = {{Mirai Compiled for New Processors Surfaces in the Wild}}, date = {2019-04-08}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/mirai-compiled-for-new-processor-surfaces/}, language = {English}, urldate = {2019-11-26} } Mirai Compiled for New Processors Surfaces in the Wild
Mirai
2018-12-20Trend MicroAugusto Remillano II, Mark Vicente
@online{ii:20181220:with:8e827ba, author = {Augusto Remillano II and Mark Vicente}, title = {{With Mirai Comes Miori: IoT Botnet Delivered via ThinkPHP Remote Code Execution Exploit}}, date = {2018-12-20}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/with-mirai-comes-miori-iot-botnet-delivered-via-thinkphp-remote-code-execution-exploit/}, language = {English}, urldate = {2019-11-29} } With Mirai Comes Miori: IoT Botnet Delivered via ThinkPHP Remote Code Execution Exploit
Mirai
2018-07-20Palo Alto Networks Unit 42Ruchna Nigam
@online{nigam:20180720:unit:e044686, author = {Ruchna Nigam}, title = {{Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns}}, date = {2018-07-20}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/}, language = {English}, urldate = {2019-12-20} } Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns
Hakai Mirai
2017-12-13KrebsOnSecurityBrian Krebs
@online{krebs:20171213:mirai:bd2cb74, author = {Brian Krebs}, title = {{Mirai IoT Botnet Co-Authors Plead Guilty}}, date = {2017-12-13}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/}, language = {English}, urldate = {2020-01-08} } Mirai IoT Botnet Co-Authors Plead Guilty
Mirai
2017-11-24Bleeping ComputerCatalin Cimpanu
@online{cimpanu:20171124:mirai:ea4773e, author = {Catalin Cimpanu}, title = {{Mirai Activity Picks up Once More After Publication of PoC Exploit Code}}, date = {2017-11-24}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/mirai-activity-picks-up-once-more-after-publication-of-poc-exploit-code/}, language = {English}, urldate = {2019-12-20} } Mirai Activity Picks up Once More After Publication of PoC Exploit Code
Mirai
2017-07-15Github (jgamblin)Jerry Gamblin
@online{gamblin:20170715:mirai:72ffffb, author = {Jerry Gamblin}, title = {{Mirai BotNet Source Code}}, date = {2017-07-15}, organization = {Github (jgamblin)}, url = {https://github.com/jgamblin/Mirai-Source-Code}, language = {English}, urldate = {2019-12-17} } Mirai BotNet Source Code
Mirai
2016-10-27Simon Roses Femerling BlogSimon Roses
@online{roses:20161027:mirai:01bd756, author = {Simon Roses}, title = {{Mirai DDoS Botnet: Source Code & Binary Analysis}}, date = {2016-10-27}, organization = {Simon Roses Femerling Blog}, url = {http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/}, language = {English}, urldate = {2020-01-07} } Mirai DDoS Botnet: Source Code & Binary Analysis
Mirai
2016-10-01KrebsOnSecurityBrian Krebs
@online{krebs:20161001:source:796f0bc, author = {Brian Krebs}, title = {{Source Code for IoT Botnet ‘Mirai’ Released}}, date = {2016-10-01}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/}, language = {English}, urldate = {2019-07-10} } Source Code for IoT Botnet ‘Mirai’ Released
Mirai
2016-05-02John BambenekJohn Bambenek
@online{bambenek:20160502:osint:54b6791, author = {John Bambenek}, title = {{OSINT Feed}}, date = {2016-05-02}, organization = {John Bambenek}, url = {http://osint.bambenekconsulting.com/feeds/}, language = {English}, urldate = {2020-01-06} } OSINT Feed
Mirai Banjori
Yara Rules
[TLP:WHITE] elf_mirai_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule elf_mirai_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89d0 c1e005 01d0 89ca 29c2 }
            // n = 5, score = 300
            //   89d0                 | mov                 byte ptr [eax + edx], 0
            //   c1e005               | push                ebp
            //   01d0                 | cmp                 eax, -1
            //   89ca                 | je                  0x1a81
            //   29c2                 | dec                 eax

        $sequence_1 = { c7433400000000 894330 c6433801 c6433903 }
            // n = 4, score = 300
            //   c7433400000000       | mov                 eax, 0xaaaaaaab
            //   894330               | mul                 ebx
            //   c6433801             | mov                 eax, edx
            //   c6433903             | pop                 edi

        $sequence_2 = { e8???????? c7433400000000 894330 c6433801 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   c7433400000000       | cmp                 dword ptr [eax + 0x10], 4
            //   894330               | jle                 0xc76
            //   c6433801             | mov                 byte ptr [esp + ecx + 0x2010], 0

        $sequence_3 = { e8???????? c7433400000000 894330 c6433801 c6433903 }
            // n = 5, score = 300
            //   e8????????           |                     
            //   c7433400000000       | add                 esp, 0x10
            //   894330               | mov                 byte ptr [esp + 0x634], 0x2e
            //   c6433801             | mov                 byte ptr [esp + 0x635], 0x2f
            //   c6433903             | sub                 esp, 0xc

        $sequence_4 = { 807c242b00 66894304 7406 66c743064000 c643092f }
            // n = 5, score = 300
            //   807c242b00           | mov                 word ptr [ebx + 4], ax
            //   66894304             | ror                 ax, 8
            //   7406                 | mov                 word ptr [ebx + 4], ax
            //   66c743064000         | movzx               eax, byte ptr [esp + 0x68]
            //   c643092f             | movzx               esi, word ptr [esp + 0xe]

        $sequence_5 = { e9???????? e8???????? 66894314 e9???????? }
            // n = 4, score = 300
            //   e9????????           |                     
            //   e8????????           |                     
            //   66894314             | mov                 dword ptr [esp], 0x31
            //   e9????????           |                     

        $sequence_6 = { c1ea03 89d0 c1e005 01d0 89ca }
            // n = 5, score = 300
            //   c1ea03               | mov                 ebx, dword ptr [esp + 0x44]
            //   89d0                 | mov                 dword ptr [edx + 0xc], eax
            //   c1e005               | mov                 eax, dword ptr [esp + 0x28]
            //   01d0                 | lea                 eax, [eax + eax*2]
            //   89ca                 | mov                 eax, dword ptr [ebx + eax*8 + 0x10]

        $sequence_7 = { 6689432a e8???????? c7433400000000 894330 c6433801 c6433903 }
            // n = 6, score = 300
            //   6689432a             | add                 esp, 0x20
            //   e8????????           |                     
            //   c7433400000000       | test                eax, eax
            //   894330               | jle                 0x1e81
            //   c6433801             | push                eax
            //   c6433903             | mov                 edi, eax

        $sequence_8 = { 807c242b00 66894304 7406 66c743064000 }
            // n = 4, score = 300
            //   807c242b00           | push                1
            //   66894304             | lea                 eax, [esp + 0x65e]
            //   7406                 | push                eax
            //   66c743064000         | push                1

        $sequence_9 = { 8d429f 3c19 7705 8d42e0 }
            // n = 4, score = 300
            //   8d429f               | mov                 al, byte ptr [esp + 0x8c]
            //   3c19                 | mov                 dword ptr [esp + 0x10], eax
            //   7705                 | push                eax
            //   8d42e0               | mov                 al, byte ptr [esp + 0x898]

    condition:
        7 of them and filesize < 131728
}
Download all Yara Rules