MALICIOUS — 4d558807c5925f9fc31f03eb62c73a80bd521aedfd37b11b739bf42af3b45381.bin
MALICIOUS — 4d558807c5925f9fc31f03eb62c73a80bd521aedfd37b11b739bf42af3b45381.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the AsyncRAT family. 2 of 56 detection engines flagged it.
Identification
- SHA-256:
4d558807c5925f9fc31f03eb62c73a80bd521aedfd37b11b739bf42af3b45381 - SHA-1:
ba52e7f65d8f53720b858f3927df6571235bbbcc - MD5:
d0873b87cff54a9ffcc97c4628533fbd - ssdeep:
49152:TBIKazsp6ZCB7R2nBc9iSVZZJPAaRiQpw5bEq696pYAZsR5+GKHK5K2spY//I9kM:tB0ZtnBROvXyxZg3/5E3 - TLSH:
T154675CA462533125D6F5DD08F031C4DDC49BB94AD6B11EC9038BE53580EAFABA6F00B9 - Submitted as: 4d558807c5925f9fc31f03eb62c73a80bd521aedfd37b11b739bf42af3b45381.bin
- File type: elf · Size: 6807712 bytes
- Verdict: malicious (93/100) · Family: AsyncRAT
Source: MalShare · first seen 2026-10-07T19:33:38.060Z · SHA-256 verified
Detections (2 of 56 engines)
- YARA: PhishingKit (t4d): PK_Credential_Exfil_Telegram
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Why this verdict
The malicious score of 93/100 is the fusion of 6 weighted signals:
- Extracted AsyncRAT config (1 C2) - engine signal, weight 0.80, confidence 0.65
- YARA: PhishingKit (t4d) flagged PK_Credential_Exfil_Telegram (rule
PK_Credential_Exfil_Telegram) - engine signal, weight 0.70, confidence 0.70 - 1 IDS alert(s): ThreatLens Telegram bot C2/exfil - network signal, weight 0.50, confidence 0.80
- YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70 - Embedded network infrastructure: https://go.dev/doc/godebug#go-1casgstatus, https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size - static signal, weight 0.35, confidence 0.60
- Contacted 8 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (linux)
875 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- api.telegram.org
- ntp.ubuntu.com
- ADBC2/1 30a799e0111fd73f amd64 2 1963 ubuntu 668bc090116f925073bab96bbbb7587113a3221dae50c3d0f9d772ebe18ba8f
- 149.154.166.110:443 NL · Amsterdam · AS62041 Telegram Messenger Network
- 203.26.79.13 NZ · Auckland · AS24305 EdgeIX Pty Ltd
- 10.240.0.1
- 85.210.193.152 GB · London · AS8075 Microsoft Limited
- ff02::16
- ff02::1:ff12:3456
- 172.215.188.232 US · San Antonio · AS8075 Microsoft Corporation
- 185.125.190.56
- 149.154.166.110 NL · Amsterdam · AS62041 Telegram Messenger Network
- 255.255.255.255
- ff02::2
- 20.184.175.11 US · San Jose · AS8075 Microsoft Corporation
- 176.65.134.119 GB · London · AS51396 Pfcloud UG
- 57.154.63.210 US · Phoenix · AS8075 Microsoft Corporation
Dropped files
- tmp_.zxc.lock -
290a0b92873bdf4e47986dc5208037bad7527653bff700dc53c1e57eb98103c1
Embedded URLs
- https://go.dev/doc/godebug#go-1casgstatus
- https://go.dev/issue/66821
- https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
Embedded domains
- big.int
- api.telegram.org
- go.dev
- golang.org
- runtime.link
- reflectlite.rtype.name
- unicode.in
- unicode.to
- go.shape.int
- jsontext.name
- v2.name
- abi.name
- pkix.name
- godebugs.info
Embedded IP addresses
- 5.4.62.5
- 4.32.5.4
- 52.5.4.72
- 5.4.82.5
- 5.4.102.5
- 4.112.5.4
- 176.65.134.119
- 1.1.1.1
- 203.26.79.13
- 85.210.193.152
- 172.215.188.232
- 149.154.166.110
- 20.184.175.11
- 57.154.63.210
More AsyncRAT samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report