MALICIOUS — 5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd.elf
MALICIOUS — 5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prometei family. 8 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd - SHA-1:
72844ef8b6afd26fa84f7a3d3e1beabe9d8140e7 - MD5:
5638a6ce75718f872720c582b4149865 - ssdeep:
12288:4h/taqLkdfH8ytYiflIw0BEmWVeygFurhCj:4YdkVLwKvyaJj - TLSH:
T1724A23B5185D8F32E50022CDF65BEC5CFAE0569DF1A29A2D0F50F44D082E4D2E5D9E28 - Submitted as: 5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd.elf
- File type: elf · Size: 436277 bytes
- Verdict: malicious (100/100) · Family: Prometei
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (8 of 54 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Unix.Trojan.Prometei-10045451-0
- YARA: Intezer community: INTEZER_ELF_UPX_Modified
- Detect It Easy (packer/type): DIE:UPX 4.24
- Microsoft Defender: Trojan:Linux/Coinminer.B
- Emsisoft (Emergency Kit): Trojan.Linux.Prometei.6
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Prometei.a
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Prometei-10045451-0 (rule
Unix.Trojan.Prometei-10045451-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 1 finding(s), e.g. injected region in sample.bin (pid 713) (rule
linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Linux/Coinminer.B (rule
Trojan:Linux/Coinminer.B) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Prometei.6 (rule
Trojan.Linux.Prometei.6) - engine signal, weight 0.55, confidence 0.85 - 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule
tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule
INTEZER_ELF_UPX_Modified) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX 4.24 (rule
DIE:UPX 4.24) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://152.36.128, http://upx.sf.net, 68.183.204.57 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-blob, UPX 4.24 - static signal, weight 0.25, confidence 0.55
- Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
871 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- entropy.ubuntu.com
- ntp.ubuntu.com
- _dosvc._tcp.local
- desktop-hsgcbep
- 185.125.189.52:443
- 10.240.0.1
- 185.125.189.52
- 150.171.22.17
- 224.0.0.251
- ff02::fb
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- ff02::1
- ff02::16
- ff02::1:2
- 135.232.92.34
- 20.42.73.26
- 91.189.91.157
- 185.125.190.57
Dropped files
- tmp_tmp.BR4ki9heXT -
3febdb4752de7751cda33b3ad9668311af7f81f0de166740f0822a7985f030ab
Embedded URLs
- http://152.36.128
- http://upx.sf.net
Embedded domains
- d.fr
- upx.sf.net
- gnu.pro
Embedded IP addresses
- 68.183.204.57
- 10.0.204.2
- 152.36.0.128
- 150.171.22.17
- 135.232.92.34
- 20.42.73.26
- 203.26.79.13
- 172.172.255.218
More Prometei samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report