MALICIOUS — 7a104d520a9dcaf3da9ac5efb34b748fdfb472d320832db3d44566f7b5b7b9b3
MALICIOUS — 7a104d520a9dcaf3da9ac5efb34b748fdfb472d320832db3d44566f7b5b7b9b3 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 4 of 57 detection engines flagged it.
Identification
- SHA-256:
7a104d520a9dcaf3da9ac5efb34b748fdfb472d320832db3d44566f7b5b7b9b3 - SHA-1:
a9a15c04c77531d150b4e6db4846e2e2bd977aa2 - MD5:
6bba65ff5c9b3de485c41656caab3b81 - ssdeep:
768:Dt4Ry06/fOBFGYM2EkJue0zBKdQui7Rrl9X3KK65o+oRL7BeeIpI8QzbNO2dyaa:aR36HiFGY3EkJulgARrl9X6o+CFLdn - TLSH:
T118330926AE686465F03986D48C44082C02CE055C4D2DDFFD8F8BADE3486AB975EF11F9 - Submitted as: 7a104d520a9dcaf3da9ac5efb34b748fdfb472d320832db3d44566f7b5b7b9b3
- File type: elf · Size: 48540 bytes
- Verdict: malicious (99/100) · Family: Mirai
Detections (4 of 57 engines)
- ClamAV (daily): Unix.Dropper.Mirai-7135939-0
- Microsoft Defender: Backdoor:Linux/Mirai.AW!xp
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.ba
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Unix.Dropper.Mirai-7135939-0 (rule
Unix.Dropper.Mirai-7135939-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 2 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in xuatxcwhrFbjauB (pid 695) (rule
linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Backdoor:Linux/Mirai.AW!xp (rule
Backdoor:Linux/Mirai.AW!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Mirai.1 (rule
Trojan.Linux.Mirai.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.ba (rule
HEUR:Backdoor.Linux.Mirai.ba) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 172.245.36.129 - static signal, weight 0.35, confidence 0.60
- Contacted 994 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
893 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- _dosvc._tcp.local
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 172.245.36.129:9931 US · AS36352 RackNerd LLC
- 127.243.199.244
- 203.26.79.13
- 172.245.36.129 US · AS36352 RackNerd LLC
- 99.94.61.152
- 188.197.5.152
- 107.220.194.45 US · AS7018 AT&T Enterprises, LLC
- 101.70.233.59 CN · AS4837 CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN
- 54.182.21.54
- 67.119.61.58
- 100.149.235.212 US · AS21928 T-MOBILE-AS21928 - T-Mobile USA, Inc., US
- 207.191.135.248
- 39.56.128.158
Embedded IP addresses
- 239.255.255.250
- 239.255.255.25
- 172.245.36.129
- 203.26.79.13
- 99.94.61.152
- 188.197.5.152
- 107.220.194.45
- 101.70.233.59
- 54.182.21.54
- 67.119.61.58
- 100.149.235.212
- 207.191.135.248
- 39.56.128.158
- 51.2.103.55
- 87.233.54.23
- 145.180.4.147
- 117.60.173.83
- 49.102.107.18
- 47.62.64.94
- 135.134.93.172
- 202.134.85.31
- 176.180.178.138
- 14.163.27.200
- 137.181.189.253
- 87.69.103.193
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report