MALICIOUS — 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70.bin

MALICIOUS — 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 6 of 57 detection engines flagged it.

Identification

• SHA-256: 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70
• SHA-1: c51d1e88476f88e2e0256e272913f419f4694134
• MD5: 8e7e88377aae5459d5acaceae91a80ee
• ssdeep: 49152:CZLKHlog/V9KHRwKtby2pqJtbxeRXWKMb4TW:ClK6KViwKVyWm9elWrUq
• TLSH: T168593368A036F55970178A1EE3246099C9BCFFF4A11609F04FEF938B787AE43196406C
• Submitted as: 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70.bin
• File type: elf · Size: 1838060 bytes
• Verdict: malicious (96/100)

Source: MalShare · first seen 2026-09-16T06:37:34.443Z · SHA-256 verified

Detections (6 of 57 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: Intezer community: INTEZER_ELF_UPX_Modified
• Detect It Easy (packer/type): DIE:UPX 5.20
• Microsoft Defender: Trojan:Linux/CoinMiner!rfn
• Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60054651
• Kaspersky (KVRT): HEUR:Trojan.Linux.Agent.gen

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

• Microsoft Defender flagged Trojan:Linux/CoinMiner!rfn (rule Trojan:Linux/CoinMiner!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Linux.GenericKD.60054651 (rule Trojan.Linux.GenericKD.60054651) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Linux.Agent.gen (rule HEUR:Trojan.Linux.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule INTEZER_ELF_UPX_Modified) - engine signal, weight 0.40, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX 5.20 (rule DIE:UPX 5.20) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://upx.sf.net - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob, UPX 5.20 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (linux)

804 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 95.215.19.53:853 SE · Malmö · AS39287 ab stract ltd
• 1.1.1.1:853
• 130.12.180.51:43782 DE · Virtualine Technologies
• 130.12.180.51:2137 DE · Virtualine Technologies
• 1.0.0.1:853
• 31.56.209.165:2137 NL · AS209373 GOLD-MNT
• 95.215.19.53 SE · Malmö · AS39287 ab stract ltd
• 130.12.180.51 DE · Virtualine Technologies
• 10.240.0.1
• 1.1.1.1
• 1.0.0.1
• ff02::16
• 255.255.255.255
• ff02::1:ff12:3456
• ff02::1
• 31.56.209.165 NL · AS209373 GOLD-MNT
• 185.125.190.57
• ff02::2

Embedded URLs

• http://upx.sf.net

Embedded domains

• upx.sf.net

Embedded IP addresses

• 95.215.19.53
• 130.12.180.51
• 31.56.209.165

File paths

• Z:\@KSr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report