MALICIOUS — 91e67fca08e396560a20bee126f9b6c8241f8521cbc0e8b2e7b31ffed0d31537.bin

MALICIOUS — 91e67fca08e396560a20bee126f9b6c8241f8521cbc0e8b2e7b31ffed0d31537.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 6 of 56 detection engines flagged it.

Identification

• SHA-256: 91e67fca08e396560a20bee126f9b6c8241f8521cbc0e8b2e7b31ffed0d31537
• SHA-1: 2f55b482b936892a863203146c5af03d18f60aec
• MD5: 9c2cc87c3d71210e4f3d413d1df8599b
• ssdeep: 6144:VSSDPMtM4WrkhYAp8cMD9alOOSOD3nCKVJ:VSEPSWrkhYAp8caEOOjX
• TLSH: T11F44D887F3720500E6F95910256699DE37E336CDA17CACBA0216113D31A7C0F6E2DEA6
• Submitted as: 91e67fca08e396560a20bee126f9b6c8241f8521cbc0e8b2e7b31ffed0d31537.bin
• File type: elf · Size: 251512 bytes
• Verdict: malicious (99/100) · Family: Mirai

Source: MalShare · first seen 2026-10-03T05:33:27.972Z · SHA-256 verified

Detections (6 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-8041698-0
• YARA: Intezer community: INTEZER_Linux_Persistence
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Microsoft Defender: Backdoor:Linux/Mirai.GL!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40577123
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-8041698-0 (rule Unix.Trojan.Mirai-8041698-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/Mirai.GL!MTB (rule Backdoor:Linux/Mirai.GL!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40577123 (rule Trojan.Generic.40577123) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.b (rule HEUR:Backdoor.Linux.Mirai.b) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_Persistence (rule INTEZER_Linux_Persistence) - engine signal, weight 0.50, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

831 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 160.119.66.206:25565 US · New York City · AS7489 HostMem
• 127.243.197.252
• 160.119.66.206 US · New York City · AS7489 HostMem
• 10.240.0.1
• ff02::16
• 10.240.0.76
• ff02::1:ff12:3456
• 185.125.190.56
• ff02::2
• 255.255.255.255

Embedded URLs

• https://www.google.com/

Embedded domains

• www.google.com

Embedded IP addresses

• 160.119.66.206

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report