MALICIOUS — 761108b05b70757c365bd90b87ad7bc72cdd7346f3c2884fd034c77340208d13
MALICIOUS — 761108b05b70757c365bd90b87ad7bc72cdd7346f3c2884fd034c77340208d13 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mirai family. 4 of 57 detection engines flagged it.
Identification
- SHA-256:
761108b05b70757c365bd90b87ad7bc72cdd7346f3c2884fd034c77340208d13 - SHA-1:
22aa7e195f7d8316e7fc2cd90858ee217ec3ce9a - MD5:
2a1db7fa2ebac8bb3eec13afe133930b - ssdeep:
1536:e9/WjRV5vkJNQ54mRDd5cloxJuYe+cP+yLfajRnxeZB47cf:c+V5vkc54mJdiye+cP+yLfajRna/f - TLSH:
T17D3AE48BF3620104C9E69540696AA9ED27E3319D2068BCF60316017E31A7E4F5F2DDB7 - Submitted as: 761108b05b70757c365bd90b87ad7bc72cdd7346f3c2884fd034c77340208d13
- File type: elf · Size: 101480 bytes
- Verdict: malicious (98/100) · Family: Mirai
Detections (4 of 57 engines)
- ClamAV (daily): Unix.Trojan.Mirai-7135937-0
- Microsoft Defender: Backdoor:Linux/Mirai.BQ!xp
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.dx
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-7135937-0 (rule
Unix.Trojan.Mirai-7135937-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Mirai.BQ!xp (rule
Backdoor:Linux/Mirai.BQ!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Mirai.1 (rule
Trojan.Linux.Mirai.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.dx (rule
HEUR:Backdoor.Linux.Mirai.dx) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 107.174.241.209 - static signal, weight 0.35, confidence 0.60
- Contacted 996 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
871 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 107.174.241.209:60420 US · Seattle · AS36352 RackNerd LLC
- 127.243.199.100
- 36.206.96.223
- 88.119.122.223
- 88.11.115.195
- 166.22.49.222 US · Lockheed Martin Corporation
- 151.54.131.64 IT · AS1267 AS1267-MNT
- 125.53.146.186 JP · AS2516 JP00000127
- 19.154.102.100
- 156.238.176.12 US · AS11427 Cloud Innovation Support
- 203.195.252.124
- 83.254.178.107
- 87.151.170.31
- 82.211.164.234
Embedded IP addresses
- 107.174.241.209
- 36.206.96.223
- 88.119.122.223
- 88.11.115.195
- 166.22.49.222
- 151.54.131.64
- 125.53.146.186
- 19.154.102.100
- 156.238.176.12
- 203.195.252.124
- 83.254.178.107
- 87.151.170.31
- 82.211.164.234
- 205.187.190.98
- 120.36.87.217
- 139.199.161.99
- 27.194.91.8
- 121.202.60.68
- 96.163.102.59
- 223.12.66.214
- 41.98.127.229
- 193.236.108.179
- 103.133.58.99
- 181.170.208.236
- 18.32.215.19
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report