MALICIOUS — 0fabc3c1414356c76dddcc3f6547705ce21e1d19aed954a22ae5366c3a722ea4.bin

MALICIOUS — 0fabc3c1414356c76dddcc3f6547705ce21e1d19aed954a22ae5366c3a722ea4.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mirai family. 3 of 56 detection engines flagged it.

Identification

• SHA-256: 0fabc3c1414356c76dddcc3f6547705ce21e1d19aed954a22ae5366c3a722ea4
• SHA-1: ee9e39fab12562a0071b508feb2eace4cbff01a4
• MD5: bfa538484c9f8427271c66dbbccb0cbe
• ssdeep: 3072:JgWS1n5z76MTRv0WrwPLDKTfTqp/KK0IXj9fkR6:JY5z76qR/yGMip6hcR6
• TLSH: T1433D0787F3B20104D5F1182169669ACE57E236DA21BC9CB60322117E20BBD5F1E7CDE6
• Submitted as: 0fabc3c1414356c76dddcc3f6547705ce21e1d19aed954a22ae5366c3a722ea4.bin
• File type: elf · Size: 132584 bytes
• Verdict: malicious (98/100) · Family: Mirai

Source: MalShare · first seen 2026-10-15T18:42:22.626Z · SHA-256 verified

Detections (3 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-10008934-0
• Microsoft Defender: Backdoor:Linux/Mirai.LR!MTB
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.jw

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-10008934-0 (rule Unix.Trojan.Mirai-10008934-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 3 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in (pid 688) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Backdoor:Linux/Mirai.LR!MTB (rule Backdoor:Linux/Mirai.LR!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.jw (rule HEUR:Backdoor.Linux.Mirai.jw) - engine signal, weight 0.55, confidence 0.85
• Contacted 18460 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

811 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• bigr.dyn
• lkol.dyn
• ntp.ubuntu.com
• 176.65.139.40:80
• 176.65.139.40:44092
• 176.65.139.40:42742
• 176.65.139.40:38259
• 176.65.139.40:42303
• 208.252.50.213:23
• 33.190.79.31:23
• 159.197.22.49:23
• 176.196.76.191:23
• 77.127.212.14:23
• 208.102.217.143:23
• 49.214.129.186:23
• 210.171.188.31:23
• 116.145.243.245:23
• 115.217.117.129:23
• 75.20.57.37:23
• 26.120.190.117:23

Embedded domains

• wget.sh
• tftp.sh
• ftpget.sh
• curl.sh
• www.example.com
• bigr.dyn
• lkol.dyn

Embedded IP addresses

• 176.65.139.40
• 37.252.191.197
• 103.1.184.110
• 134.194.245.232
• 213.203.41.192
• 210.171.188.31
• 208.89.191.243
• 77.127.212.14
• 136.3.185.216
• 37.240.208.92
• 170.135.76.127
• 116.145.243.245
• 31.56.167.89
• 125.152.240.237
• 99.45.113.226
• 13.224.203.252
• 103.181.115.163
• 92.14.76.151
• 46.225.243.32
• 120.128.9.168
• 130.33.190.252
• 26.120.190.117
• 49.214.129.186
• 36.37.229.236
• 138.79.18.62

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report