Report Overview

  1. Visited public
    2024-10-31 02:20:37
    Tags
  2. URL

    112.31.180.128:49740/bin.sh

  3. Finishing URL

    about:privatebrowsing

  4. IP / ASN
    112.31.180.128

    #9808 China Mobile Communications Group Co., Ltd.

    Title
    about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
6
Threat Detection Systems
16

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
112.31.180.128unknownunknownNo dataNo data

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

SeveritySource IPDestination IPAlert
high 112.31.180.128Client IP
high 112.31.180.128Client IP
high 112.31.180.128Client IP
high 112.31.180.128Client IP
high 112.31.180.128Client IP
high 112.31.180.128Client IP

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
medium112.31.180.128:49740/bin.shDetects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
medium112.31.180.128:49740/bin.shDetects multiple Mirai variants
medium112.31.180.128:49740/bin.shDetects Generic ShellScript Downloader
medium112.31.180.128:49740/bin.shLinux.Trojan.Mirai
medium112.31.180.128:49740/bin.shLinux.Trojan.Mirai
medium112.31.180.128:49740/bin.shLinux.Trojan.Mirai

OpenPhish

No alerts detected


PhishTank

No alerts detected


Mnemonic Secure DNS

No alerts detected


Quad9 DNS
SeverityIndicatorAlert
medium112.31.180.128Sinkholed

ThreatFox

No alerts detected


Files detected

  1. URL

    112.31.180.128:49740/bin.sh

  2. IP

    112.31.180.128

  3. ASN

    #9808 China Mobile Communications Group Co., Ltd.

  1. File type

    ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV)

    Size

    308 kB (307960 bytes)

  2. Hash

    eec5c6c219535fba3a0492ea8118b397

    292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21

    Detections

    AnalyzerVerdictAlert
    Public Nextron YARA rulesmalware
    Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
    YARAhub by abuse.chmalware
    Detects multiple Mirai variants
    YARAhub by abuse.chmalware
    Detects Generic ShellScript Downloader
    Elastic Security YARA Rulesmalware
    Linux.Trojan.Mirai
    Elastic Security YARA Rulesmalware
    Linux.Trojan.Mirai
    Elastic Security YARA Rulesmalware
    Linux.Trojan.Mirai
    VirusTotalmalicious
    ClamAVmalicious
    Unix.Trojan.Mirai-7100807-0

JavaScript (0)

HTTP Transactions (1)

URLIPResponseSize
112.31.180.128:49740/bin.sh
112.31.180.128200 OK308 kB