MALICIOUS — 24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e.elf
MALICIOUS — 24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Prometei family. 7 of 56 detection engines flagged it.
Identification
- SHA-256:
24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e - SHA-1:
bb92d1fa432c22cb8c2eae9059e5585e5f506100 - MD5:
eaa88ee35c44ac3d0392117610f58b57 - ssdeep:
12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdK:Fs6pyCC/Ya2hpi6T6N4E - TLSH:
T1514A239D451D2AF1C28928D738F97D8F52E325EA18E8119983D0D4AB2F4E383B093D75 - Submitted as: 24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e.elf
- File type: elf · Size: 449083 bytes
- Verdict: malicious (97/100) · Family: Prometei
Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Unix.Trojan.Prometei-10045451-0
- YARA: Intezer community: INTEZER_ELF_UPX_Modified
- Detect It Easy (packer/type): DIE:UPX 4.24
- Microsoft Defender: Trojan:Linux/Coinminer.B
- Emsisoft (Emergency Kit): Trojan.Linux.Prometei.5
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Prometei.a
Why this verdict
The malicious score of 97/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Prometei-10045451-0 (rule
Unix.Trojan.Prometei-10045451-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 1 finding(s), e.g. injected region in sample.bin (pid 666) (rule
linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule
INTEZER_ELF_UPX_Modified) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX 4.24 (rule
DIE:UPX 4.24) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://103.176, http://upx.sf.net, 45.55.121.171 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-blob, UPX 4.24 - static signal, weight 0.25, confidence 0.55
Dynamic analysis (linux)
860 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 79.243.254.169.in-addr.arpa
- 252.0.0.224.in-addr.arpa
- 255.255.254.169.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- ff02::1:3
- 224.0.0.252
- 169.254.255.255
- 224.0.0.251
- ff02::fb
- 10.240.0.1
- ff02::2
- ff02::16
- ff02::1:ff12:3456
- ff02::1
- 10.240.0.255
Embedded URLs
- http://103.176
- http://upx.sf.net
Embedded domains
- upx.sf.net
- gnu.pro
Embedded IP addresses
- 45.55.121.171
- 10.10.0.128
- 103.0.0.176
More Prometei samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report