MALICIOUS — 76e35fa72ca06d33b0cf7ba5233b43d5db906955d5a62bb8305ea9437d553ecc
MALICIOUS — 76e35fa72ca06d33b0cf7ba5233b43d5db906955d5a62bb8305ea9437d553ecc is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mirai family. 4 of 57 detection engines flagged it.
Identification
- SHA-256:
76e35fa72ca06d33b0cf7ba5233b43d5db906955d5a62bb8305ea9437d553ecc - SHA-1:
03a7ef5c56a78ecc3299b250604bd66b42d950b6 - MD5:
33710b4785f0572ad912cbdf3bd5e4e4 - ssdeep:
1536:Ynir9NC4F2QkAdBLG09+RAqVIvJNUQvdg8EA937Avk:0irD2DAXLR+2SIvJNddrJVUvk - TLSH:
T162385B21845E2A12D0B7DC5CA81D1CFCA067F4DE327F838948ABD41E97A883B14651EF - Submitted as: 76e35fa72ca06d33b0cf7ba5233b43d5db906955d5a62bb8305ea9437d553ecc
- File type: elf · Size: 82048 bytes
- Verdict: malicious (98/100) · Family: Mirai
Detections (4 of 57 engines)
- ClamAV (daily): Unix.Dropper.Mirai-7135944-0
- Microsoft Defender: Backdoor:Linux/Gafgyt.BF!MTB
- Emsisoft (Emergency Kit): Trojan.Generic.31263491
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Gafgyt.a
Why this verdict
The malicious score of 98/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Unix.Dropper.Mirai-7135944-0 (rule
Unix.Dropper.Mirai-7135944-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Gafgyt.BF!MTB (rule
Backdoor:Linux/Gafgyt.BF!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.31263491 (rule
Trojan.Generic.31263491) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Gafgyt.a (rule
HEUR:Backdoor.Linux.Gafgyt.a) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 1.9.2.14, 4.0.249.0, 8.8.8.8 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (linux)
869 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 193.176.29.254:23890 GB · AS25369 HYDRA-MNT
- 172.215.188.225 US · San Antonio · AS8075 Microsoft Limited
- 193.176.29.254 GB · AS25369 HYDRA-MNT
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- 20.190.167.149
- 10.240.0.1
- 224.0.0.251
- ff02::fb
- 74.179.77.204 US · Moses Lake · AS8075 Microsoft Corporation
- 85.210.193.152 GB · AS8075 MICROSOFT-MAINT
- 51.132.193.104 GB · London · AS8075 Microsoft Limited UK
- ff02::1:ff4c:1d1d
Embedded IP addresses
- 1.9.2.14
- 4.0.249.0
- 8.8.8.8
- 172.215.188.225
- 193.176.29.254
- 74.179.77.204
- 85.210.193.152
- 51.132.193.104
- 20.42.179.192
- 48.211.4.16
- 4.150.223.114
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report