SUSPICIOUS — 156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed.bin

SUSPICIOUS — 156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (47/100), attributed to the XMRig family. 4 of 53 detection engines flagged it.

Identification

• SHA-256: 156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed
• SHA-1: 95716d70357d72b9e633a0b9d8a80b3daf7b57cf
• MD5: eb45c920be598f053afb3d56918aa1ea
• ssdeep: 12288:xYd6DCNgKL6dQusl1tUBdoHfjdxAOEDapo1UvOHHaypCoaHXZ9ul/mMAXA:xYsCNgBnudKp6o1YOHwkl/mH
• TLSH: T1DC529F6414337600E179EE04A02551DDA077F2F0717E68AE860F991D927C2EBEAF1DA3
• Submitted as: 156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed.bin
• File type: elf · Size: 971096 bytes
• Verdict: suspicious (47/100) · Family: XMRig

Source: MalShare · first seen 2026-08-14T21:55:57.568Z · SHA-256 verified

Detections (4 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.Generic.40397063
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.mj

Why this verdict

The suspicious score of 47/100 is the fusion of 4 weighted signals:

• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs, 1.9.1.3, 1.9.1.1 - static signal, weight 0.35, confidence 0.60
• Contacted 3 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

893 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• desktop-hsgcbep
• 250.255.255.239.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 176.65.139.228:6678 GB · London · AS215240 Silent Connection Ltd.
• ff02::1:3
• 224.0.0.252
• 10.240.0.1
• 176.65.139.228 GB · London · AS215240 Silent Connection Ltd.
• 10.240.0.255
• 23.221.133.123
• ff02::fb
• 224.0.0.251
• ff02::1:ff12:3456
• ff02::1
• ff02::16
• 239.255.255.250

Embedded URLs

• https://github.com/xmrig/xmrig/releases/download/v6.18.0/xmrig-6.18.0-linux-static-x64.tar.gz
• https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs

Embedded domains

• github.com
• bugs.launchpad.net

Embedded IP addresses

• 1.9.1.3
• 1.9.1.1
• 4.0.219.6
• 176.65.139.228
• 52.168.117.168

More XMRig samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report