MALICIOUS — 35e6eb04aa90b9d77aae8a24c31512d51720b48c6dcf2897740754b8584d829c.bin

MALICIOUS — 35e6eb04aa90b9d77aae8a24c31512d51720b48c6dcf2897740754b8584d829c.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mirai family. 5 of 56 detection engines flagged it.

Identification

• SHA-256: 35e6eb04aa90b9d77aae8a24c31512d51720b48c6dcf2897740754b8584d829c
• SHA-1: fa4c70f39a52d9359ddbf29a2d4d1feff4659993
• MD5: 6957ddfb595cf50fcd7d78c703cf3d9b
• ssdeep: 3072:JjXRA+rh1Q6mz5EEPp65ITTu74qAjbQaWXOtB3TPUBE0QGM5tI:vGznx6cEpAPQaMOtZU6S/
• TLSH: T11B3C5C26AE19108BF535C9D48C904E2E03CE15BCDD29DADC5F8A2E93085EAD31DB05F6
• Submitted as: 35e6eb04aa90b9d77aae8a24c31512d51720b48c6dcf2897740754b8584d829c.bin
• File type: elf · Size: 114748 bytes
• Verdict: malicious (100/100) · Family: Mirai

Source: MalShare · first seen 2026-10-13T21:07:16.369Z · SHA-256 verified

Detections (5 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-7755770-0
• Hash: MalShare: known-malicious-hash
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Backdoor:Linux/Mirai.AW!xp
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.ki

Why this verdict

The malicious score of 100/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-7755770-0 (rule Unix.Trojan.Mirai-7755770-0) - engine signal, weight 0.90, confidence 0.95
• Hash: MalShare flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/Mirai.AW!xp (rule Backdoor:Linux/Mirai.AW!xp) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.ki (rule HEUR:Backdoor.Linux.Mirai.ki) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (linux)

169 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• ff02::1
• ff02::2
• 91.189.91.157
• ff02::16
• ff02::1:ff12:3456
• 255.255.255.255

Embedded domains

• wget.sh
• tftp.sh
• ftpget.sh
• curl.sh
• www.example.com

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report