SUSPICIOUS — 976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182.elf

SUSPICIOUS — 976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100). 5 of 56 detection engines flagged it.

Identification

• SHA-256: 976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182
• SHA-1: 6c7fcd72d3e5a6984a2b2d2cd52fa409e6c48b08
• MD5: d643efa94609f81116f476e3186815b4
• ssdeep: 49152:sx+H3Pv2kvxObfy+qdlFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvLO:pH/+kvAb0lUvmMy5qUVkf3xQa52+3z
• TLSH: T10C5EF16041A77221C6F9EF46A02059ED8047F448B2B22D899107931FB6F835FEAF15F6
• Submitted as: 976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182.elf
• File type: elf · Size: 2953928 bytes
• Verdict: suspicious (49/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX 5.02
• Detect It Easy (packer/type): DIE:UPX 5.02
• Microsoft Defender: Trojan:Linux/CoinMiner!rfn
• Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60054802
• Kaspersky (KVRT): HEUR:Trojan.Linux.Agent.gen

Why this verdict

The suspicious score of 49/100 is the fusion of 3 weighted signals:

• Detect It Easy (packer/type) flagged DIE:UPX 5.02 (rule DIE:UPX 5.02) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://upx.sf.net - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX 5.02 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (linux)

1066 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• ff02::1:3
• 224.0.0.252
• 10.240.0.1
• 169.254.255.255
• 10.240.0.255
• 224.0.0.251
• ff02::fb
• 185.125.190.57
• ff02::2
• 239.255.255.250
• ff02::1:ff12:3456
• 185.125.190.56
• ff02::1:ff4c:1d1d

Embedded URLs

• http://upx.sf.net

Embedded domains

• index.crates.io
• x.mx
• 7.ly
• upx.sf.net
• u.pro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report