MALICIOUS — 336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0.elf
MALICIOUS — 336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Bushido family. 4 of 54 detection engines flagged it.
Identification
- SHA-256:
336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0 - SHA-1:
8eccb26b2367a367160ab29637830cb2ecc00b0a - MD5:
616d444d5d09d06f7a2c79d9e04d517d - ssdeep:
3072:W+HeB+EYnNXOQ9EoKcXj5aMXRpVpbLbInh5KWZO:rHeB+EYN+Q9EkXNaMhpVmh5KW4 - TLSH:
T1514119276A2960DAF4248AC9CCD44A7C03CE229D9D25CEEC5F8A5EE3181DA534D701F6 - Submitted as: 336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0.elf
- File type: elf · Size: 184348 bytes
- Verdict: malicious (97/100) · Family: Bushido
Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified
Detections (4 of 54 engines)
- ClamAV (daily): Unix.Trojan.Mirai-9441505-0
- Microsoft Defender: Backdoor:Linux/Bushido.A!xp
- Emsisoft (Emergency Kit): Gen:Variant.Linux.DDoS.2
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw
Why this verdict
The malicious score of 97/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-9441505-0 (rule
Unix.Trojan.Mirai-9441505-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Bushido.A!xp (rule
Backdoor:Linux/Bushido.A!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Linux.DDoS.2 (rule
Gen:Variant.Linux.DDoS.2) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: http://185.183.34.45/LjEZs/awsec2, http://185.183.34.45/LjEZs/vacron, http://185.183.34.45/LjEZs/netgear2 - static signal, weight 0.35, confidence 0.60
- Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
893 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- _dosvc._tcp.local
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 224.0.0.251
- ff02::fb
- 203.26.79.13
- ff02::1:3
- 224.0.0.252
- 10.240.0.1
- 10.240.0.255
- 85.210.196.11
- 48.211.4.16
- 185.125.190.58
- 185.125.190.56
- ff02::2
Dropped files
- tmp_tmp.N3cKyBDHHc -
3bbcf8b656bd26d7104d70f7ea461b32344acbce1ff30a6a489018f198a06c42
Embedded URLs
- http://185.183.34.45/LjEZs/awsec2
- http://185.183.34.45/LjEZs/vacron
- http://185.183.34.45/LjEZs/netgear2
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://185.183.34.45/LjEZs/dlink
- http://185.183.34.45/LjEZs/jaws
- http://185.183.34.45/LjEZs/crossweb
- http://purenetworks.com/HNAP1/
- http://185.183.34.45/LjEZs/hnap
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
- http://185.183.34.45/LjEZs/tr064
- http://185.183.34.45/LjEZs/netgear+-O+/tmp/netgear
- http://185.183.34.45/LjEZs/realtek
- http://185.183.34.45/LjEZs/gpon80+-O+-
- http://185.183.34.45/LjEZs/gpon8080+-O+-
Embedded domains
- 255.net
- stresser.pw
- schemas.xmlsoap.org
- purenetworks.com
- www.w3.org
Embedded IP addresses
- 185.183.34.45
- 192.168.0.100
- 176.32.33.88
- 203.26.79.13
- 85.210.196.11
- 48.211.4.16
- 104.21.58.99
- 92.223.78.30
- 20.42.73.27
More Bushido samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report