MALICIOUS — 03a1fc9b3cdd97b957dfb39a70b044f64b330c05df59b75f5c16d96eae053216.elf

MALICIOUS — 03a1fc9b3cdd97b957dfb39a70b044f64b330c05df59b75f5c16d96eae053216.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 03a1fc9b3cdd97b957dfb39a70b044f64b330c05df59b75f5c16d96eae053216
• SHA-1: cf947a5d9992600754e90effa44fbf4564b0d7f8
• MD5: 51e07a1dea39b599af64e875aca48745
• ssdeep: 1536:qnPjFljLKNGA17rMy5cpUu7ysE9/Xv+iWpnvPww14+3Ipe1peR:SPjrLKNGYMyStg/Gi8v54+3I8He
• TLSH: T133397C7641073056D2F0DD51B81D6DFEA093F26D7132B28D811AD50DA3EC227ADB82AE
• Submitted as: 03a1fc9b3cdd97b957dfb39a70b044f64b330c05df59b75f5c16d96eae053216.elf
• File type: elf · Size: 89200 bytes
• Verdict: malicious (90/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Dropper.Mirai-7135890-0
• Microsoft Defender: Trojan:Linux/Multiverze!rfn
• Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60054822
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw

Why this verdict

The malicious score of 90/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Unix.Dropper.Mirai-7135890-0 (rule Unix.Dropper.Mirai-7135890-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: 204.10.194.60 - static signal, weight 0.35, confidence 0.60
• Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

927 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• 0.81.150.144
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 204.10.194.60 CA · AS206216 Advin Services LLC
• 52.123.129.14 US · Redmond · AS8075 Microsoft Corporation
• 10.240.0.255
• 74.178.76.128 IE · Dublin · AS8075 Microsoft Corporation
• 169.254.255.255
• ff02::16
• 10.240.0.1
• ff02::2

Embedded IP addresses

• 204.10.194.60
• 52.123.129.14
• 74.178.76.128
• 52.168.112.67
• 172.172.255.217
• 72.154.7.106
• 20.42.73.28
• 72.153.5.136
• 4.150.223.107

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report