MALICIOUS — 9f11e24531de2a3e5de458d335485805c725ca08ee27d60b66887676c36f0537.elf
MALICIOUS — 9f11e24531de2a3e5de458d335485805c725ca08ee27d60b66887676c36f0537.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Mirai family. 4 of 53 detection engines flagged it.
Identification
- SHA-256:
9f11e24531de2a3e5de458d335485805c725ca08ee27d60b66887676c36f0537 - SHA-1:
8c0ff7c24a247290a2e5b07990987814a57aae03 - MD5:
d40471aa330a6759937e5865b2dae1c0 - ssdeep:
3072:yNhorO9tS34s3XyWhwedcga4bZAbwTZBr:yNupIKXyWhwEcglbG0TZBr - TLSH:
T1E83E2921AF6A2469F83946C98C84453D11CD026C8E28CFF9CFCA5EE3841FA975D715E4 - Submitted as: 9f11e24531de2a3e5de458d335485805c725ca08ee27d60b66887676c36f0537.elf
- File type: elf · Size: 138840 bytes
- Verdict: malicious (97/100) · Family: Mirai
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (4 of 53 engines)
- ClamAV (daily): Unix.Trojan.Mirai-10060415-0
- Microsoft Defender: Trojan:Linux/Mirai.Z!MTB
- Emsisoft (Emergency Kit): Trojan.Generic.40353949
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.kl
Why this verdict
The malicious score of 97/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-10060415-0 (rule
Unix.Trojan.Mirai-10060415-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Linux/Mirai.Z!MTB (rule
Trojan:Linux/Mirai.Z!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.40353949 (rule
Trojan.Generic.40353949) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 83.168.69.141, 83.168.110.191 - static signal, weight 0.35, confidence 0.60
Dynamic analysis
This sample is built for ARM, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.
Embedded domains
- t.me
Embedded IP addresses
- 83.168.69.141
- 83.168.110.191
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report