MALICIOUS — 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958.bin

MALICIOUS — 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Persistence family. 5 of 56 detection engines flagged it.

Identification

• SHA-256: 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958
• SHA-1: 062489854f53126e973d40912cf37998cce7d9a6
• MD5: 97d37135220d891a54c70fc11a8b3207
• ssdeep: 3072:hwX94di45I6KxdP7PqWODWn0HHqXElxaGjXi9J:hm94di/xx7PAO0n9lxa02
• TLSH: T1B844D41B9EB67C14CBB0B575D54338EEB5B204833AA8CC69030896770B586138F5DB9E
• Submitted as: 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958.bin
• File type: elf · Size: 255608 bytes
• Verdict: malicious (98/100) · Family: Persistence

Source: MalShare · first seen 2026-10-03T06:13:27.902Z · SHA-256 verified

Detections (5 of 56 engines)

• YARA: Intezer community: INTEZER_Linux_Persistence
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60057618
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged Trojan.Linux.GenericKD.60057618 (rule Trojan.Linux.GenericKD.60057618) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.b (rule HEUR:Backdoor.Linux.Mirai.b) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_Persistence (rule INTEZER_Linux_Persistence) - engine signal, weight 0.50, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

859 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 160.119.66.206:25565 US · New York City · AS7489 HostMem
• 127.243.197.252
• 160.119.66.206 US · New York City · AS7489 HostMem
• 10.240.0.1
• 185.125.190.56
• ff02::1
• ff02::2
• ff02::16
• ff02::1:ff12:3456
• 255.255.255.255

Embedded URLs

• https://www.google.com/

Embedded domains

• www.google.com

Embedded IP addresses

• 160.119.66.206

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report