MALICIOUS — 9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017.bin
MALICIOUS — 9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 57 detection engines flagged it.
Identification
- SHA-256:
9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017 - SHA-1:
43b2e1d831f0364d76402e10d5000c86e11b3dd5 - MD5:
a7daa7220982c2d3018e076589028ec0 - ssdeep:
1536:LoNzvcUOwp+ExtGmvmwxKHTfV9Stq2XFuHqe18QVJu9:EhnOK+EfLvmqKzf8qA3BQVQ9 - TLSH:
T17C3402A14BBCE313CEF1403196F0849F3D546BA9B2A5C1DD7CEC0D55A0C8A0B9562CE5 - Submitted as: 9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017.bin
- File type: elf · Size: 55496 bytes
- Verdict: malicious (92/100)
Source: MalShare · first seen 2026-08-23T16:10:06.766Z · SHA-256 verified
Detections (5 of 57 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- YARA: Intezer community: INTEZER_ELF_UPX_Modified
- Detect It Easy (packer/type): DIE:UPX 3.94
- Microsoft Defender: flagged
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.h
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.h (rule
HEUR:Backdoor.Linux.Mirai.h) - engine signal, weight 0.55, confidence 0.85 - YARA: Intezer community flagged INTEZER_ELF_UPX_Modified (rule
INTEZER_ELF_UPX_Modified) - engine signal, weight 0.40, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX 3.94 (rule
DIE:UPX 3.94) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://upx.sf.net - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-blob, UPX 3.94 - static signal, weight 0.25, confidence 0.55
Dynamic analysis (linux)
1167 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- _dosvc._tcp.local
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- 10.240.0.1
- 224.0.0.251
- ff02::fb
- 185.125.190.58
- 4.150.223.98 US · Des Moines · AS8075 Microsoft Corporation
- 20.42.73.28 US · Baltimore · AS8075 Microsoft Corporation
- 20.190.142.163
- 52.182.141.63 US · Des Moines · AS8075 Microsoft Corporation
- 20.165.94.63 US · San Antonio · AS8075 Microsoft Corporation
- 85.210.196.11 GB · London · AS8075 Microsoft Limited
Embedded URLs
- http://upx.sf.net
Embedded domains
- upx.sf.net
Embedded IP addresses
- 4.150.223.98
- 20.42.73.28
- 52.182.141.63
- 20.165.94.63
- 85.210.196.11
- 4.150.223.111
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report