SUSPICIOUS — libaecore.so

SUSPICIOUS — libaecore.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 1 of 57 detection engines flagged it.

Identification

• SHA-256: 2f38c6c92064c61ff0548b61d5a34ddbd06c9b94360aa9b039558f6a181d3ddd
• SHA-1: 40b7748d54fd3f2a48be4348f30ba9b65c3d56c6
• MD5: 2c005d2ade95ea9e8b7031ee3214a6d7
• ssdeep: 6144:al1wbxhU823CJQRCjrAnzRXoNJRDFOOMrIVp:61wbA823CaR8ehoPqMp
• TLSH: T11942F738ABAA3051E43496C9DCA0493D02CE341C8E6DDBDD4F8A5D93584DB632C7B1E6
• Submitted as: libaecore.so
• File type: elf · Size: 211792 bytes
• Verdict: suspicious (58/100)

Detections (1 of 57 engines)

• Microsoft Defender: flagged

Why this verdict

The suspicious score of 58/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: 8.3.16.12 - static signal, weight 0.35, confidence 0.60

Dynamic analysis

This sample is built for ARM, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

Embedded domains

• www.di-mgt.com.au

Embedded IP addresses

• 8.3.16.12

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report