MALICIOUS — 6db70b0aeb29ba9cbf062b6d19f6956853a5ae992268ca64ac09e96e00fcb641

MALICIOUS — 6db70b0aeb29ba9cbf062b6d19f6956853a5ae992268ca64ac09e96e00fcb641 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 5 of 57 detection engines flagged it.

Identification

• SHA-256: 6db70b0aeb29ba9cbf062b6d19f6956853a5ae992268ca64ac09e96e00fcb641
• SHA-1: 5d61c649e78ebc14e13b2134020e0123e429cebe
• MD5: ae1588f29af17ce324b9556d66c14d31
• ssdeep: 768:zzaB/HTfpYtWja5FLMawtAXe0bhqRDoO7lwXgCmlryeN74uBChcoCD0CgLcE:zzaB/rpY6OXwtAdGoswQDNywBe40Cg
• TLSH: T1F7347D263D174B14F89F399D8182F2BF0DD97129AC5B789D1AB079FF69C0103A826027
• Submitted as: 6db70b0aeb29ba9cbf062b6d19f6956853a5ae992268ca64ac09e96e00fcb641
• File type: elf · Size: 54704 bytes
• Verdict: malicious (99/100) · Family: Mirai

Detections (5 of 57 engines)

• ClamAV (daily): Unix.Trojan.Mirai-7100807-0
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Microsoft Defender: Backdoor:Linux/Gafgyt.P!MTB
• Emsisoft (Emergency Kit): Trojan.Linux.Backdoor.C
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.n

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-7100807-0 (rule Unix.Trojan.Mirai-7100807-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in sample.bin (pid 702) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Backdoor:Linux/Gafgyt.P!MTB (rule Backdoor:Linux/Gafgyt.P!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Linux.Backdoor.C (rule Trojan.Linux.Backdoor.C) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.n (rule HEUR:Backdoor.Linux.Mirai.n) - engine signal, weight 0.55, confidence 0.85
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

849 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 48.211.4.16 US · Ashburn · AS8075 Microsoft Limited
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 10.240.0.1
• ff02::16
• 224.0.0.251
• ff02::fb
• 169.254.255.255
• 224.0.0.22
• ff02::1
• ff02::2
• ff02::1:ff4c:1d1d
• ff02::1:ff12:3456

Embedded IP addresses

• 48.211.4.16
• 172.172.255.216

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report