MALICIOUS — 76a40843091ba46b5cd6f3fe5f3ad9c451614fbb53c6936837d980d7350a885c.elf
MALICIOUS — 76a40843091ba46b5cd6f3fe5f3ad9c451614fbb53c6936837d980d7350a885c.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mirai family. 4 of 53 detection engines flagged it.
Identification
- SHA-256:
76a40843091ba46b5cd6f3fe5f3ad9c451614fbb53c6936837d980d7350a885c - SHA-1:
16ac1244fdb3d4197381ca82d2a6db0f03e63489 - MD5:
001e9d95e595c5b53d230bb644b7494e - ssdeep:
12288:knjbCKSw8SUyr2m6Av/HMA6YHQsoVs51gPd+:SPowQm6kvMAJH1Y - TLSH:
T109538D4E97B88585F5E851AA61628EBC66E7C81D50BBFCBDC39093B671C02B70172313 - Submitted as: 76a40843091ba46b5cd6f3fe5f3ad9c451614fbb53c6936837d980d7350a885c.elf
- File type: elf · Size: 1057472 bytes
- Verdict: malicious (89/100) · Family: Mirai
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (4 of 53 engines)
- ClamAV (daily): Unix.Trojan.Mirai-7100807-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.39487109
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Gafgyt.bj
Why this verdict
The malicious score of 89/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-7100807-0 (rule
Unix.Trojan.Mirai-7100807-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: http://95.155.151.113/gpon+-O+/tmp/gaf, http://purenetworks.com/HNAP1/, http://95.155.151.113/sensi.sh - static signal, weight 0.35, confidence 0.60
Dynamic analysis (linux)
971 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- 10.240.0.1
- ff02::16
- ff02::fb
- 224.0.0.251
- 4.243.160.21 KR · Busan · AS8075 Microsoft Corporation
- 239.255.255.250
- 150.171.109.145
Embedded URLs
- http://95.155.151.113/gpon+-O+/tmp/gaf
- http://purenetworks.com/HNAP1/
- http://95.155.151.113/sensi.sh
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://www.debian.org/Bugs/
Embedded domains
- purenetworks.com
- sensi.sh
- www.w3.org
- schemas.xmlsoap.org
- www.debian.org
Embedded IP addresses
- 95.155.151.113
- 192.168.0.100
- 4.243.160.21
- 4.150.223.103
- 74.178.76.44
- 74.178.240.61
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report