MALICIOUS — 15249d8fcd6c59755622790123259c8a06a0a10d8ce4de66e394609cef2abb2b.elf
MALICIOUS — 15249d8fcd6c59755622790123259c8a06a0a10d8ce4de66e394609cef2abb2b.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the mimban family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
15249d8fcd6c59755622790123259c8a06a0a10d8ce4de66e394609cef2abb2b - SHA-1:
a117b36dc901d95f2bb63937cc035e5046524448 - MD5:
37aeb403ec4979626e2ec85380296439 - ssdeep:
24576:0W7jGc8zHxUiby/oX24zzgMmszlIKVWNafrB7QkBfzk9N:0IGc8zRUiby/oX24zzgMmszlIKVWNad - TLSH:
T13756C81C462F6935E436E54F551699FE808BB068A2335ECF440FE50E90CC5ABFA316B8 - Submitted as: 15249d8fcd6c59755622790123259c8a06a0a10d8ce4de66e394609cef2abb2b.elf
- File type: elf · Size: 1395184 bytes
- Verdict: malicious (100/100) · Family: mimban
Detections (6 of 56 engines)
- YARA: ESET research: mimban
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Microsoft Defender: Ransom:Linux/Qilin.A!MTB
- Emsisoft (Emergency Kit): Trojan.Linux.Ransom.EV
- Kaspersky (KVRT): HEUR:Trojan-Ransom.Linux.Qilin.a
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 8 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - YARA: ESET research flagged mimban (rule
mimban) - engine signal, weight 0.70, confidence 0.70 - Microsoft Defender flagged Ransom:Linux/Qilin.A!MTB (rule
Ransom:Linux/Qilin.A!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Ransom.EV (rule
Trojan.Linux.Ransom.EV) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Linux.Qilin.a (rule
HEUR:Trojan-Ransom.Linux.Qilin.a) - engine signal, weight 0.55, confidence 0.85 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://31.41.244.100, http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion, http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion - static signal, weight 0.35, confidence 0.60
Dynamic analysis (linux)
814 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- ntp.ubuntu.com
- 10.240.0.1
- ff02::16
- ff02::1:ff12:3456
- 10.240.0.77
- 185.125.190.57
- 255.255.255.255
- ff02::2
Embedded URLs
- https://31.41.244.100
- http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion
- http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
- https://www.torproject.org/download/
Embedded domains
- openssl.org
- www.torproject.org
- kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion
- ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
Embedded IP addresses
- 31.41.244.100
More mimban samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report