MALICIOUS — 53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543.elf
MALICIOUS — 53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Multiverze family. 5 of 27 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543 - SHA-1:
0be1308a128833dc35126e930c7c73262e864c63 - MD5:
00b613234448433d2aa878aa979c9f7e - ssdeep:
49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZE/ - TLSH:
T1D075D0A2B453252AE2907906A436047F051F64B3F8702B4F547BE46D41EBFEB66C89F0 - Submitted as: 53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543.elf
- File type: elf · Size: 27099136 bytes
- Verdict: malicious (98/100) · Family: Multiverze
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (5 of 27 engines)
- YARA: MalwareAnalyser community pack: TL_UPX_Packed
- YARA: Yara-Rules community: YR_AntiVM_Sandbox
- Cyble Vision: Cyble Vision: Malicious
- Microsoft Defender: Trojan:Linux/Multiverze!rfn
- Kaspersky (KVRT): HEUR:Trojan.Linux.Miner.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- Cyble Vision flagged Cyble Vision: Malicious (rule
Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Linux/Multiverze!rfn (rule
Trojan:Linux/Multiverze!rfn) - engine signal, weight 0.55, confidence 0.85 - 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule
tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90 - YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule
TL_UPX_Packed) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule
YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ident.me/if-modified-sinceillegal, 5.4.32.5, 4.52.5.4 - static signal, weight 0.35, confidence 0.60
- Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
929 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- entropy.ubuntu.com
- _dosvc._tcp.local
- ntp.ubuntu.com
- 185.125.189.54:443
- 185.125.189.54
- 203.26.79.13
- 10.240.0.1
- ff02::fb
- 224.0.0.251
- 13.69.116.105
- ff02::16
- 255.255.255.255
- 185.125.190.56
- ff02::1:ff12:3456
- ff02::2
- 185.125.190.58
- ff02::1
Dropped files
- tmp_tmp.sMHha3pvLw -
b148019b53e02a1aac4b5e98f63ceaf9815bc3de3895a6b18823879935f5fdb7
Embedded URLs
- https://ident.me/if-modified-sinceillegal
Embedded domains
- big.int
- pkix.name
- sftp.work
- runtime.name
- dnsmessage.name
- golang.org
- github.com
- ipgrab.io
- ident.me
- ipinfo.io
- ip.seeip.org
- inet-ip.info
- api.ipify.org
- checkip.amazonaws.com
- discord.com
Embedded IP addresses
- 5.4.32.5
- 4.52.5.4
- 62.5.4.72
- 5.4.82.5
- 5.4.102.5
- 4.112.5.4
- 203.26.79.13
- 13.69.116.105
More Multiverze samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report