MALICIOUS — 520ed89c5c0533749a280c1a0716afd8119db1cb94a88aece868fd8ff705eef1.bin

MALICIOUS — 520ed89c5c0533749a280c1a0716afd8119db1cb94a88aece868fd8ff705eef1.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Mirai family. 3 of 57 detection engines flagged it.

Identification

• SHA-256: 520ed89c5c0533749a280c1a0716afd8119db1cb94a88aece868fd8ff705eef1
• SHA-1: b67202356f4034ad4a46abec3e48b956ecec2db7
• MD5: 03707c62bfb338175596424a718a0001
• ssdeep: 3072:tmIYPRAOJnNCeuu+iRE8YPbC1fAK8Pm262yRaA0rsBfTnwWiXi9SR:tmhL1+izwbCufm26FRaRrs5wpQW
• TLSH: T1863C4C269E1910CBF535C9D88C804A6E03CE15BCDD29DADC5F8A2EA3185DAD31DB01F6
• Submitted as: 520ed89c5c0533749a280c1a0716afd8119db1cb94a88aece868fd8ff705eef1.bin
• File type: elf · Size: 113364 bytes
• Verdict: malicious (96/100) · Family: Mirai

Source: MalShare · first seen 2026-10-15T18:37:22.565Z · SHA-256 verified

Detections (3 of 57 engines)

• ClamAV (daily): Unix.Trojan.Mirai-10008934-0
• Microsoft Defender: Backdoor:Linux/Mirai.AW!xp
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.jw

Why this verdict

The malicious score of 96/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-10008934-0 (rule Unix.Trojan.Mirai-10008934-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/Mirai.AW!xp (rule Backdoor:Linux/Mirai.AW!xp) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.jw (rule HEUR:Backdoor.Linux.Mirai.jw) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (linux)

883 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• 185.125.190.56
• ff02::1
• ff02::2
• ff02::16
• ff02::1:ff12:3456
• 255.255.255.255

Embedded domains

• wget.sh
• tftp.sh
• ftpget.sh
• curl.sh
• www.example.com

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report