MALICIOUS — 85c6051e686c2d34b070b4b56b55fab7796a7647f8c226b84fb329bbd5dca200.elf

MALICIOUS — 85c6051e686c2d34b070b4b56b55fab7796a7647f8c226b84fb329bbd5dca200.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 85c6051e686c2d34b070b4b56b55fab7796a7647f8c226b84fb329bbd5dca200
• SHA-1: 59a21af703241604531cabb4763fbd4a1a3e6766
• MD5: 0903af52678b5ab90b9f1a8ffed2182c
• ssdeep: 1536:CZptTNWMjWpanmFq1SMLHnnHzTVp461rZlOyeC1f6Mds/RdV:0xNWMjAani7c46xZlObMWV
• TLSH: T1E33AF88BF3721504D6F5151026169BEE67F3338A61ACACBA0217107E31A7D0F1E2DE96
• Submitted as: 85c6051e686c2d34b070b4b56b55fab7796a7647f8c226b84fb329bbd5dca200.elf
• File type: elf · Size: 97740 bytes
• Verdict: malicious (86/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-9858729-0
• Microsoft Defender: Backdoor:Linux/Gafgyt.X!MTB
• Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 86/100 is the fusion of 1 weighted signal:

• ClamAV (daily) flagged Unix.Trojan.Mirai-9858729-0 (rule Unix.Trojan.Mirai-9858729-0) - engine signal, weight 0.90, confidence 0.95

Dynamic analysis (linux)

866 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• _dosvc._tcp.local
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• ntp.ubuntu.com
• desktop-hsgcbep(2)._dosvc._tcp.local
• 127.243.199.100
• 10.240.0.1
• 151.101.30.172
• 224.0.0.251
• ff02::fb
• 239.255.255.250
• ff02::1
• ff02::1:ff12:3456
• 185.125.190.56
• 135.234.160.245
• ff02::16
• 255.255.255.255
• ff02::2
• 185.125.190.57

Embedded IP addresses

• 135.234.160.245

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report