MALICIOUS — 100_EarthKrahang_20240404.bin

MALICIOUS — 100_EarthKrahang_20240404.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Dinodasrat family. 3 of 52 detection engines flagged it.

Identification

• SHA-256: a2c3073fa5587f8a70d7def7fd8355e1f6d20eb906c3cd4df8c744826cb81d91
• SHA-1: dd5f99687aa953b422f27035b13398bcdf8e0401
• MD5: 20b4ac6be041b72862e1645953a951eb
• ssdeep: 6144:SQPczBa3vgEvQN9glnA1wcP5g2GQOO/3xsk0M1l3H99zZnI51z49Q:YBvEvqR1jPKQDZsB2l3H9w
• TLSH: T1AA47F95A1623322BD1E58F03E096F96D9C63E1399CAB1A9F81065C0F40693CFF5F485A
• Submitted as: 100_EarthKrahang_20240404.bin
• File type: elf · Size: 323016 bytes
• Verdict: malicious (97/100) · Family: Dinodasrat

Detections (3 of 52 engines)

• ClamAV (daily): {MD5}bin.trojan.dinodasrat.7866.UNOFFICIAL
• Microsoft Defender: Backdoor:Linux/DinodasRAT.A!MTB
• Emsisoft (Emergency Kit): Generic.Linux.DinodasRAT.A.8EBB88D6

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.dinodasrat.7866.UNOFFICIAL (rule {MD5}bin.trojan.dinodasrat.7866.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Linux/DinodasRAT.A!MTB (rule Backdoor:Linux/DinodasRAT.A!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Linux.DinodasRAT.A.8EBB88D6 (rule Generic.Linux.DinodasRAT.A.8EBB88D6) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: 8.8.8.8, 199.231.211.19 - static signal, weight 0.35, confidence 0.60
• Contacted 16 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

866 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• _dosvc._tcp.local
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 150.171.22.17
• 10.240.0.1
• 74.179.71.159
• 135.232.92.34
• 203.26.79.13
• ff02::16
• 255.255.255.255
• ff02::1:ff12:3456
• 239.255.255.250

Dropped files

• tmp_tmp.vEGxNwqZze - 486532c5a693e42ef9d239f4a79c0ed572a0ec37219d36572e2cb17600f63f77

Embedded domains

• ch.sh

Embedded IP addresses

• 8.8.8.8
• 199.231.211.19
• 150.171.22.17
• 74.179.71.159
• 135.232.92.34
• 203.26.79.13
• 40.126.14.163
• 4.247.188.224
• 57.154.63.210
• 57.155.101.212
• 20.184.175.23
• 23.40.52.123
• 172.172.255.217
• 4.150.223.112

More Dinodasrat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report