MALICIOUS — 631edb65012fe8dff1eb511edc1660fc8cede0bafe531f507cc491654e47fd6f.elf

MALICIOUS — 631edb65012fe8dff1eb511edc1660fc8cede0bafe531f507cc491654e47fd6f.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 6 of 56 detection engines flagged it.

Identification

• SHA-256: 631edb65012fe8dff1eb511edc1660fc8cede0bafe531f507cc491654e47fd6f
• SHA-1: 0d250e3b3ddda504c8c68c638937bc7a1e19e4e9
• MD5: c7e79791d415c7a7f2968dce6c6bf48f
• ssdeep: 768:XCkO5tOKfhaFFTnUqVcLJCLUD5KG0HOdrLG9FUfAnd4YCbEnbcuyD7UkWykkAe:XRO5tOK0ZnUqCgif0HELG9FUoOJbEnoV
• TLSH: T1EB32E06BA0E10572F0CB84B6C805A4AF22652213A7FECDB4C5A9109A278D8F75DD3285
• Submitted as: 631edb65012fe8dff1eb511edc1660fc8cede0bafe531f507cc491654e47fd6f.elf
• File type: elf · Size: 43928 bytes
• Verdict: malicious (83/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: Intezer community: INTEZER_ELF_UPX_Modified
• Detect It Easy (packer/type): DIE:UPX 3.94
• Microsoft Defender: Trojan:Script/Sabsik.EN.A!ml
• Emsisoft (Emergency Kit): Trojan.Generic.40355986
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.h

Why this verdict

The malicious score of 83/100 is the fusion of 7 weighted signals:

• Memory forensics: 2 finding(s), e.g. injected region in N+N (pid 704) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule INTEZER_ELF_UPX_Modified) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX 3.94 (rule DIE:UPX 3.94) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://upx.sf.net - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob, UPX 3.94 - static signal, weight 0.25, confidence 0.55
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

870 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 94.154.43.237:31339
• 94.154.43.237
• 10.240.0.1
• 255.255.255.255
• ff02::1:ff12:3456
• ff02::16
• 185.125.190.58
• ff02::2

Embedded URLs

• http://upx.sf.net

Embedded domains

• upx.sf.net

Embedded IP addresses

• 94.154.43.237

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report