MALICIOUS — 217ecebcd7218b8157fd7a64ec82943b88191dab7f04fa89e717aa5e9c8fefe2.elf

MALICIOUS — 217ecebcd7218b8157fd7a64ec82943b88191dab7f04fa89e717aa5e9c8fefe2.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the REvil family. 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 217ecebcd7218b8157fd7a64ec82943b88191dab7f04fa89e717aa5e9c8fefe2
• SHA-1: cb415eca867540d8df5dbc553d1a0ee2f395825f
• MD5: 54a90406076af0bfa8d8adfa442a8b89
• ssdeep: 1536:kRulLQ+ro3gTPf8Y52Z4VktYTHLbryMOI9xrNAF2DUl7zKwyw+Q3UYyuUyTcSr5:xlLPmCPf64oYzLvZhAMQ+qM
• TLSH: T17E3C0922AB662469F83946DD8C84443C01CD075D8E28DEF9CECA6FD3841FA935DB11E5
• Submitted as: 217ecebcd7218b8157fd7a64ec82943b88191dab7f04fa89e717aa5e9c8fefe2.elf
• File type: elf · Size: 121376 bytes
• Verdict: malicious (97/100) · Family: REvil

Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• Microsoft Defender: Backdoor:Linux/Mirai.FO!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40315013
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.gen

MITRE ATT&CK

• T1105
• T1059.004

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

• 1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
• 1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Backdoor:Linux/Mirai.FO!MTB (rule Backdoor:Linux/Mirai.FO!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40315013 (rule Trojan.Generic.40315013) - engine signal, weight 0.55, confidence 0.85
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: 217.60.195.143 - static signal, weight 0.35, confidence 0.60
• Contacted 3 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Contacted 3 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

881 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• entropy.ubuntu.com
• ntp.ubuntu.com
• desktop-hsgcbep
• 185.125.189.54:443
• 127.243.205.184
• 185.125.189.54
• 10.240.0.1
• 10.240.0.76
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• ff02::1
• ff02::1:ff4c:1d1d
• ff02::16
• 255.255.255.255
• 185.125.190.56
• ff02::1:ff12:3456
• 224.0.0.22
• ff02::2
• ff02::1:2

Dropped files

• tmp_tmp.7hInQH3FrP - 94b04e1588963bd627ea828f56de53d9537905fa6249243d46fee455b2345368

Embedded IP addresses

• 217.60.195.143

More REvil samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report