MALICIOUS — 874d61242ed0493ffc8f00fa619244cb2311515208fd54abf157f615c5ca5358
MALICIOUS — 874d61242ed0493ffc8f00fa619244cb2311515208fd54abf157f615c5ca5358 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mirai family. 4 of 57 detection engines flagged it.
Identification
- SHA-256:
874d61242ed0493ffc8f00fa619244cb2311515208fd54abf157f615c5ca5358 - SHA-1:
8d7bc7f371c7eceb0b0623d2189aa00cfc430657 - MD5:
99682ee6e80e3da1b9e5e97730345140 - ssdeep:
3072:67xtm1z0+kJdBBUsXTNLcXzMY4et3Hscl7mUUOI+HaXuj:Itmh0+6d/cXzMY4et3Hscl7mUUcNj - TLSH:
T1DB406283E3225018C6FAB551B96A35DD53E2378D60287EB21218616C72E7D4F8F0DDB2 - Submitted as: 874d61242ed0493ffc8f00fa619244cb2311515208fd54abf157f615c5ca5358
- File type: elf · Size: 166000 bytes
- Verdict: malicious (98/100) · Family: Mirai
Detections (4 of 57 engines)
- ClamAV (daily): Unix.Dropper.Mirai-7135868-0
- Microsoft Defender: Backdoor:Linux/Mirai.BN!MTB
- Emsisoft (Emergency Kit): Trojan.Generic.31185135
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Unix.Dropper.Mirai-7135868-0 (rule
Unix.Dropper.Mirai-7135868-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Mirai.BN!MTB (rule
Backdoor:Linux/Mirai.BN!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.31185135 (rule
Trojan.Generic.31185135) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.b (rule
HEUR:Backdoor.Linux.Mirai.b) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 205.185.114.71 - static signal, weight 0.35, confidence 0.60
- Contacted 993 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
854 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 205.185.114.71:2616 US · AS53667 PONYNET - FranTech Solutions, US
- 127.243.199.100
- 20.165.94.63
- 205.185.114.71 US · AS53667 PONYNET - FranTech Solutions, US
- 158.183.216.217 US · Lockheed Martin Corporation
- 189.161.237.217
- 110.5.67.41 PH · AS45499 RHODALYN CLARETE
- 38.45.51.52
- 183.128.121.233
- 85.173.251.185
- 100.16.17.187 US · AS701 UUNET - Verizon Business, US
- 14.95.155.48 KR · Seoul · AS4766 Korea Telecom
- 91.166.191.248
- 106.41.149.130 CN · AS4134 Chinanet Hostmaster
Embedded IP addresses
- 192.168.3.100
- 205.185.114.71
- 20.165.94.63
- 158.183.216.217
- 189.161.237.217
- 110.5.67.41
- 38.45.51.52
- 183.128.121.233
- 85.173.251.185
- 100.16.17.187
- 14.95.155.48
- 91.166.191.248
- 106.41.149.130
- 58.83.9.243
- 71.162.182.142
- 8.160.37.85
- 110.231.238.164
- 71.186.149.191
- 42.26.112.74
- 179.220.95.232
- 115.79.46.209
- 95.33.19.109
- 212.170.17.125
- 211.165.74.11
- 69.89.93.4
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report