MALICIOUS — 2d92d151af47fb2e7d569a5cbf5d3bac202add4a83807168469f1c2cc6e4cd0e.elf
MALICIOUS — 2d92d151af47fb2e7d569a5cbf5d3bac202add4a83807168469f1c2cc6e4cd0e.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the Bushido family. 3 of 26 detection engines flagged it.
Identification
- SHA-256:
2d92d151af47fb2e7d569a5cbf5d3bac202add4a83807168469f1c2cc6e4cd0e - SHA-1:
9f0e08936df7875c7587e3b15b86a91d97939547 - MD5:
7af83ffb9f128dab09a7cf4717c63f1f - ssdeep:
3072:u8rwskV7wHWvINewzi9QksCG21aikLntZdANTS+u6a7tvtxJGa4xrSuyG/:uEwTV7w2vINCPend61ar2uu3 - TLSH:
T1F9426B1141237255D2E2DD06F42CBCEDA053B49E60722ACD8217C95D679C32FEE782AE - Submitted as: 2d92d151af47fb2e7d569a5cbf5d3bac202add4a83807168469f1c2cc6e4cd0e.elf
- File type: elf · Size: 199272 bytes
- Verdict: malicious (88/100) · Family: Bushido
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (3 of 26 engines)
- Microsoft Defender: Backdoor:Linux/Bushido.A!xp
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.7
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Backdoor:Linux/Bushido.A!xp (rule
Backdoor:Linux/Bushido.A!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Mirai.7 (rule
Trojan.Linux.Mirai.7) - engine signal, weight 0.55, confidence 0.85 - 1 IDS alert(s): ThreatLens dynamic-DNS C2 lookup (duckdns) - network signal, weight 0.50, confidence 0.80
- Embedded network infrastructure: http://185.183.34.45/LjEZs/awsec2, http://185.183.34.45/LjEZs/vacron, http://185.183.34.45/LjEZs/netgear2 - static signal, weight 0.35, confidence 0.60
- Contacted 12 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
868 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- reavercncv3.duckdns.org
- desktop-hsgcbep
- 217.60.195.187:1302 JP · Tokyo · AS18811 GOLD IP L.L.C-FZ
- ff02::1:3
- 224.0.0.252
- 10.240.0.1
- 10.240.0.255
- 8.8.8.8 US · Mountain View · AS15169 Google LLC
- ff02::fb
- 224.0.0.251
- 217.60.195.187 JP · Tokyo · AS18811 GOLD IP L.L.C-FZ
- 169.254.255.255
- 239.255.255.250
- 20.190.167.18
- 20.165.94.63 US · San Antonio · AS8075 Microsoft Corporation
Dropped files
- tmp_tmp.OzD4BeRkZp -
d990fd259ff1226bc24975069307ea550e3b84661b26358abbdc01d43518918f
Embedded URLs
- http://185.183.34.45/LjEZs/awsec2
- http://185.183.34.45/LjEZs/vacron
- http://185.183.34.45/LjEZs/netgear2
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://185.183.34.45/LjEZs/dlink
- http://185.183.34.45/LjEZs/jaws
- http://185.183.34.45/LjEZs/crossweb
- http://purenetworks.com/HNAP1/
- http://185.183.34.45/LjEZs/hnap
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
- http://185.183.34.45/LjEZs/tr064
- http://185.183.34.45/LjEZs/netgear+-O+/tmp/netgear
- http://185.183.34.45/LjEZs/realtek
- http://185.183.34.45/LjEZs/gpon80+-O+-
- http://185.183.34.45/LjEZs/gpon8080+-O+-
- http://217.60.195.187/sshex.sh
Embedded domains
- 255.net
- stresser.pw
- schemas.xmlsoap.org
- purenetworks.com
- www.w3.org
- discord.com
- osboxes.org
- sshex.sh
- example.com
- www.ovh.com
- cloud.service.net
- reavercncv3.duckdns.org
Embedded IP addresses
- 185.183.34.45
- 192.168.0.100
- 176.32.33.88
- 217.60.195.187
- 20.165.94.63
- 72.145.35.100
- 40.84.97.4
More Bushido samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report