MALICIOUS — 094_EarthKrahang_20240404.bin
MALICIOUS — 094_EarthKrahang_20240404.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Dinodasrat family. 4 of 52 detection engines flagged it.
Identification
- SHA-256:
6302acdfce30cec5e9167ff7905800a6220c7dda495c0aae1f4594c7263a29b2 - SHA-1:
8f6840d7b6b43d37293fc37c1636132b5934876b - MD5:
f1cf940f9e64edbd21f30249926c7e03 - ssdeep:
6144:CGPHyDt8mAYoXF6Msmvvvami695EsEVI3dKnn5Fd+YROv:CEstnAb6MG695JNKnn5M - TLSH:
T12546D75A1223312AC1DA8F07E056FABE4C73F11959AA1A9FC106990F50653CFF5F8C4A - Submitted as: 094_EarthKrahang_20240404.bin
- File type: elf · Size: 302480 bytes
- Verdict: malicious (100/100) · Family: Dinodasrat
Detections (4 of 52 engines)
- ClamAV (daily): {MD5}bin.trojan.dinodasrat.7870.UNOFFICIAL
- Cyble Vision: Cyble Vision: DinodasRAT
- Microsoft Defender: Backdoor:Linux/DinodasRAT.A!MTB
- Emsisoft (Emergency Kit): Trojan.Linux.DinodasRAT.E
Why this verdict
The malicious score of 100/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.dinodasrat.7870.UNOFFICIAL (rule
{MD5}bin.trojan.dinodasrat.7870.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Cyble Vision flagged Cyble Vision: DinodasRAT (rule
Cyble Vision: DinodasRAT) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/DinodasRAT.A!MTB (rule
Backdoor:Linux/DinodasRAT.A!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.DinodasRAT.E (rule
Trojan.Linux.DinodasRAT.E) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 8.8.8.8 - static signal, weight 0.35, confidence 0.60
- Contacted 15 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (linux)
887 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- update.microsoft-setting.com
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 250.255.255.239.in-addr.arpa
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- 224.0.0.251
- ff02::fb
- 8.8.8.8
- 10.240.0.1
- ff02::16
- 74.178.76.128
- ff02::1
Dropped files
- tmp_tmp.wyOQCAf6Z4 -
4237a89b14a3f16ea0fd6dc463583b96356110f16e9652149ae679093a4bd4cd
Embedded domains
- ch.sh
- update.microsoft-setting.com
Embedded IP addresses
- 8.8.8.8
- 74.178.76.128
- 4.247.188.233
- 40.84.97.4
- 20.42.179.204
- 104.18.21.226
- 13.89.179.12
- 4.150.223.98
- 135.232.92.34
- 20.190.167.65
- 20.42.73.25
- 40.126.14.160
- 72.145.35.112
More Dinodasrat samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report