MALICIOUS — wirenet-memtest.elf

MALICIOUS — wirenet-memtest.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wirenet family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 6ab025e1967bfdebb3bc35615b613fba8942572a44a7ef455c4817db2d451891
• SHA-1: fce1c7c5784c8d03debcd04eedfc9fb4ff625cd0
• MD5: db3e264750c7a1e7398769269462d8e2
• ssdeep: 1536:CkdOMtSwcfp9f25MgHmtS+IekQiPT5cL:CkdOMtufO5MgmYxQiP
• TLSH: T1D536E4DE4128576BF2C46220A8775ABE801FB06A71331BDC02C1D12DF2FD56BE5BA056
• Submitted as: wirenet-memtest.elf
• File type: elf · Size: 64411 bytes
• Verdict: malicious (99/100) · Family: Wirenet

Detections (5 of 53 engines)

• capa (capabilities): capability:credential-access
• ClamAV (daily): Unix.Trojan.Wirenet-9869411-0
• Microsoft Defender: Backdoor:Linux/NetWiredRC.A
• Emsisoft (Emergency Kit): Trojan.Linux.Netweird.1
• Kaspersky (KVRT): Backdoor.Linux.Wirenet.a

MITRE ATT&CK

• T1555
• T1003

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Wirenet-9869411-0 (rule Unix.Trojan.Wirenet-9869411-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/NetWiredRC.A (rule Backdoor:Linux/NetWiredRC.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Linux.Netweird.1 (rule Trojan.Linux.Netweird.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Backdoor.Linux.Wirenet.a (rule Backdoor.Linux.Wirenet.a) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• Contacted 10 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

844 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ntp.ubuntu.com
• _dosvc._tcp.local
• WORKGROUP
• 250.255.255.239.in-addr.arpa
• ff02::1:3
• 224.0.0.252
• 20.184.175.3 US · San Jose · AS8075 Microsoft Corporation
• 10.240.0.255
• 224.0.0.251
• ff02::fb
• 10.240.0.1
• 224.0.0.22
• ff02::16
• 239.255.255.250
• 135.233.95.144 US · Des Moines · AS8075 Microsoft Limited

Dropped files

• tmp_tmp.Xw2DnA0w2O - f1d090725444bd2e6fc57b46eb43370a10386e6b768ca2e1f196fc20895c8c7a

Embedded IP addresses

• 20.184.175.3
• 135.233.95.144
• 92.223.78.30
• 40.84.85.40
• 48.211.4.16
• 20.42.65.91
• 52.168.112.66
• 172.215.188.232

More Wirenet samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report