MALICIOUS — 5505a1b1ccf42bccbab584e1dd8dce9b9622bb6e9ee87f72fd596e7900fa65a4.bin

MALICIOUS — 5505a1b1ccf42bccbab584e1dd8dce9b9622bb6e9ee87f72fd596e7900fa65a4.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mirai family. 5 of 57 detection engines flagged it.

Identification

• SHA-256: 5505a1b1ccf42bccbab584e1dd8dce9b9622bb6e9ee87f72fd596e7900fa65a4
• SHA-1: 136dce5d12d982f311098c48969fedac48a28851
• MD5: 88696b02e5aed80b35fe6086023e103e
• ssdeep: 49152:HagRD+x5fl0OVbZyGENsVhsPWMdaN7BJBJtTpiB+MuB5EB:H/Dol0OVbZyGENsRpTJtdiB+5EB
• TLSH: T146672A001F6DA721C93684BA9C70833D35DE4C9A9F3AAFE88E964F53809ED770D91644
• Submitted as: 5505a1b1ccf42bccbab584e1dd8dce9b9622bb6e9ee87f72fd596e7900fa65a4.bin
• File type: elf · Size: 7274680 bytes
• Verdict: malicious (100/100) · Family: Mirai

Source: MalShare · first seen 2026-09-16T06:17:34.516Z · SHA-256 verified

Detections (5 of 57 engines)

• ClamAV (daily): Unix.Trojan.Mirai-10056451-0
• YARA: Intezer community: INTEZER_Kaiji_Chaos_Go_Bot
• YARA: JPCERT/CC: JPCERT_LODEINFO
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• Kaspersky (KVRT): HEUR:Trojan-DDoS.Linux.Agent.av

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-10056451-0 (rule Unix.Trojan.Mirai-10056451-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.85, confidence 0.70
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in sample.bin (pid 712) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-DDoS.Linux.Agent.av (rule HEUR:Trojan-DDoS.Linux.Agent.av) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Kaiji_Chaos_Go_Bot (rule INTEZER_Kaiji_Chaos_Go_Bot) - engine signal, weight 0.60, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• Embedded network infrastructure: https://go.dev/issue/66821, http://www.semrush.com/bot.html, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

861 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 176.65.139.206:9111 GB · London · AS215240 Silent Connection Ltd.
• 176.65.139.206 GB · London · AS215240 Silent Connection Ltd.
• 10.240.0.1
• 185.125.190.56
• ff02::1
• ff02::2
• 10.240.0.76
• ff02::16
• ff02::1:ff12:3456
• 255.255.255.255

Embedded URLs

• https://go.dev/issue/66821
• http://www.semrush.com/bot.html
• https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
• http://www.google.com/bot.html
• http://www.years
• http://.jpg
• http://www.interpretation
• https://www.recent
• http://www.wencodeURIComponent
• http://www.icon
• http://www.hortcut
• http://www.w3.org/shortcut
• http://.css
• http://www.css

Embedded domains

• big.int
• abi.name
• pkix.name
• godebugs.info
• golang.org
• github.com
• 2github.com
• 3github.com
• 4github.com
• go.dev
• www.semrush.com
• v.to
• avantbrowser.com
• www.google.com
• atomic.store
• runtime.link
• reflectlite.name.name
• reflectlite.rtype.name
• unicode.to
• go.shape.int
• eq.io
• exec.in
• rand.int
• eq.net
• hash.net

Embedded IP addresses

• 5.4.62.5
• 4.32.5.4
• 52.5.4.72
• 5.4.82.5
• 5.4.112.5
• 6.3.1.13
• 2.6.17.13
• 5.0.2.4
• 4.1.8.0
• 5.0.2.6
• 5.0.2.5
• 4.2.8.0
• 4.1.7.0
• 2.6.24.2
• 4.6.0.167
• 4.0.223.3
• 1.9.0.7
• 1.8.1.3
• 1.9.2.3
• 1.8.0.7
• 1.8.1.1
• 1.8.1.9
• 1.8.1.7
• 1.8.1.6
• 1.8.1.4

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report