Essential information

Value / Name

1ef03a82eea195e64a8f193fe0a50c5b78e0801f

Confidence

100/100

Revoked

Yes

Valid from

15/01/2024 11:36

Valid until

19/04/2025 12:36

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 02:45

Author / Source

AlienVault

Description

Pattern

rule mirai_rimasuta
{
    meta:
        description = "mirai_rimasuta proxy client"
        author = "xlab"
        date = "2023-11-22"

    strings:
        $str_seed = {BE BA 49 48}
        $chacha20key = {8F EA E2 F1 84 F6 B2 A3 D8 BF F0 E9 9E F7 B2 FB}

    condition:
        all of them
}

Labels / Tags

Labels: botnet chacha20 mirai rimasuta

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.