# ET SCAN ELF/Mirai Variant
**URL:** https://community.emergingthreats.net/t/et-scan-elf-mirai-variant/2303
**Category:** Rule Signatures
**Tags:** malware
**Created:** [December 29, 2024, 8:09am UTC](https://community.emergingthreats.net/t/et-scan-elf-mirai-variant/2303 "2024-12-29T08:09:24Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@MalPRE](https://community.emergingthreats.net/u/MalPRE)
#### Post date: [December 29, 2024, 8:09am UTC](https://community.emergingthreats.net/t/et-scan-elf-mirai-variant/2303/1 "2024-12-29T08:09:24Z")
We have recently detected a new wave of attacks using Mirai variants, and here are two notable rules:
```auto
alert udp any any -> any any (msg:"ET SCAN ELF/Mirai Variant UDP (Inbound)"; content:"|38 C4 FB 98 76 1F FC FE F4 00 00 00 01 63 31 7B 62 36 3E B1 A8 93 A8 61 98 8B 11 2A 3F 7C 1E AA BF C0 63 AD B7 50 68 A0 D6 2D 0E 17 3D F8 D4 F4 39 69 8D 69 0D 7D|"; sid:1000001; rev:1;)
```
```auto
alert udp any any -> any any (msg:"ET SCAN ELF/Mirai Variant UDP (Inbound)"; content:"|A5 E4 43 C7 00 3F 10 16 01 12 2F F8 3C E1 D0 5D 49 2A 43 A4 25 77 00 00 00 F2 60 25 D8 FF FF FF FF F4 6D 89 0B DC 36 47 F7 3A A5 38 8D|"; sid:1000002; rev:1;)
```
Reference URL: [In-depth Analysis of a New Mirai Variant - RrUZi / Malware Protocol Reverse Engineering Analyst](https://rruzi.github.io/In-depth-Analysis-of-a-New-Mirai-Variant/)
---
### Author:  [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)
#### Post date: [December 31, 2024, 5:33pm UTC](https://community.emergingthreats.net/t/et-scan-elf-mirai-variant/2303/2 "2024-12-31T17:33:09Z")
These are in for QA today, thank you!
---
### Author:  [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)
#### Post date: [December 31, 2024, 10:00pm UTC](https://community.emergingthreats.net/t/et-scan-elf-mirai-variant/2303/3 "2024-12-31T22:00:07Z")
Thanks @MalPRE !
- 2058707 - ET SCAN ELF/Mirai Variant UDP (Inbound) M1 (scan.rules)
- 2058708 - ET SCAN ELF/Mirai Variant UDP (Inbound) M2 (scan.rules)