MALICIOUS — 3f97e89c7969f3b91d47fa62ef6c6e42bc7c820ab6e798bfdab97149cd923fbf.elf

MALICIOUS — 3f97e89c7969f3b91d47fa62ef6c6e42bc7c820ab6e798bfdab97149cd923fbf.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

SHA-256: 3f97e89c7969f3b91d47fa62ef6c6e42bc7c820ab6e798bfdab97149cd923fbf
SHA-1: eec21addedf521c864f0e4d670903c0d56c30982
MD5: 292409d9644234a18929dcc5e7c62ca5
ssdeep: 1536:ZjJGU3HNqYvQtGuNM6W8FwGXAyy/QKYVZJfC4IpehmFVbVXHtA:pJG8fYtGuNM66X9QNVzDhmFBZtA
TLSH: T19F381AC9FD7A5D04F7F448E800F2449E9B4158AB88E9BB39434713A79AAB217177C813
Submitted as: 3f97e89c7969f3b91d47fa62ef6c6e42bc7c820ab6e798bfdab97149cd923fbf.elf
File type: elf · Size: 82080 bytes
Verdict: malicious (86/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

ClamAV (daily): Unix.Trojan.Mirai-6981989-0
Microsoft Defender: Backdoor:Linux/Mirai.BO!xp
Emsisoft (Emergency Kit): Trojan.Linux.Mirai.39487095
Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 86/100 is the fusion of 1 weighted signal:

ClamAV (daily) flagged Unix.Trojan.Mirai-6981989-0 (rule Unix.Trojan.Mirai-6981989-0) - engine signal, weight 0.90, confidence 0.95

Dynamic analysis (linux)

1100 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ff02::1:3
224.0.0.252
10.240.0.1
10.240.0.255
239.255.255.250
ff02::16
ff02::1:ff12:3456
ff02::1
ff02::fb
224.0.0.251
91.189.91.157
ff02::2
ff02::1:2

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report