MALICIOUS — 138c3624e5ce22208e7b7edbc67e13adfef8b142e17e4d54e619981387c373e3.bin

MALICIOUS — 138c3624e5ce22208e7b7edbc67e13adfef8b142e17e4d54e619981387c373e3.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 138c3624e5ce22208e7b7edbc67e13adfef8b142e17e4d54e619981387c373e3
• SHA-1: 5bcc9ca815c565d4738ab90f51d038cc879c130e
• MD5: aef5f2037d4c0c3fc2e285993eccb134
• ssdeep: 3072:zElRAZKeiAZmTOEVCOKhty5fM7JcuXj/uGavDXOUop118JZIgoiN1X5t3:RwTn3KhkqJcuXyGavDXOUoT16IDiNR
• TLSH: T1203D3A269A1A10DBF935C9C48C90496D43CD05BCDD29DADC6F8E2DA3085E6D31EF01E6
• Submitted as: 138c3624e5ce22208e7b7edbc67e13adfef8b142e17e4d54e619981387c373e3.bin
• File type: elf · Size: 128800 bytes
• Verdict: malicious (99/100) · Family: Mirai

Source: MalShare · first seen 2026-10-13T21:42:16.155Z · SHA-256 verified

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-7755770-0
• Hash: MalShare: known-malicious-hash
• Microsoft Defender: Backdoor:Linux/Mirai.AW!xp
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.ki

Why this verdict

The malicious score of 99/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-7755770-0 (rule Unix.Trojan.Mirai-7755770-0) - engine signal, weight 0.90, confidence 0.95
• Hash: MalShare flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/Mirai.AW!xp (rule Backdoor:Linux/Mirai.AW!xp) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.ki (rule HEUR:Backdoor.Linux.Mirai.ki) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (linux)

789 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ff02::1
• ff02::2
• ff02::1:ff12:3456
• 10.240.0.76
• 10.240.0.1
• 255.255.255.255
• ff02::16

Embedded domains

• wget.sh
• tftp.sh
• ftpget.sh
• curl.sh
• www.example.com

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report