MALICIOUS — 161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6.elf

MALICIOUS — 161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Multiverze family. 4 of 54 detection engines flagged it.

Identification

• SHA-256: 161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6
• SHA-1: ef8036eb4097789577eff62f6c9580fa130e7d56
• MD5: 427258462c745481c1ae47327182acd3
• ssdeep: 49152:e0a9cuyWrb/T4vO90dL3BmAFd4A64nsfJyBnmWiXpFUUXGo0331m98Hds71gnoa:e0Lda/Uvd3qG6bpsE
• TLSH: T1BF605CA803537621D5F59D04F432C4DCDA4BB84A92B41D8D8306E97B01DAFABD6F10AB
• Submitted as: 161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6.elf
• File type: elf · Size: 3690496 bytes
• Verdict: malicious (96/100) · Family: Multiverze

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• YARA: JPCERT/CC: JPCERT_LODEINFO
• Cyble Vision: Cyble Vision: Malicious
• Microsoft Defender: Trojan:Linux/Multiverze
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Agent.gen

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Linux/Multiverze (rule Trojan:Linux/Multiverze) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: 5.4.32.5, 4.52.5.4, 62.5.4.72 - static signal, weight 0.35, confidence 0.60
• Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

875 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• ntp.ubuntu.com
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 224.0.0.251
• ff02::fb
• 10.240.0.1
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• ff02::16
• 23.40.52.123
• 23.40.52.148
• 185.125.190.56
• ff02::2
• 20.89.1.10

Dropped files

• tmp_tmp.PonmQIIo3s - 8135c36fa6f20f591334a820308ec64171f87e990126311192d81c8e0f1498dd

Embedded domains

• big.int
• runtime.name
• dnsmessage.name
• golang.org
• github.com
• 2github.com
• openssh.com
• mailbox.org
• runtime.name.name
• reflectlite.name.name
• unicode.to
• reflect.name.name
• eq.io
• os.link
• syscall.link
• rand.int
• eq.golang.org
• eq.github.com

Embedded IP addresses

• 5.4.32.5
• 4.52.5.4
• 62.5.4.72
• 5.4.82.5
• 5.4.102.5
• 4.112.5.4
• 192.168.0.1
• 192.168.0.2
• 23.40.52.123
• 23.40.52.148
• 20.89.1.10
• 20.190.142.165
• 104.16.212.131

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report