MALICIOUS — b66b26a35de9e13a2aef100404cfd64ea4bab0cb3ddaf98a0a2d6860d1055fea.bin

MALICIOUS — b66b26a35de9e13a2aef100404cfd64ea4bab0cb3ddaf98a0a2d6860d1055fea.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Persistence family. 5 of 57 detection engines flagged it.

Identification

• SHA-256: b66b26a35de9e13a2aef100404cfd64ea4bab0cb3ddaf98a0a2d6860d1055fea
• SHA-1: 0cc1ef985f1dec343e519cf327417a8419c5cf84
• MD5: 19d9a78d043dfe0289028acaf519c8b4
• ssdeep: 3072:EYdKkSYKyMBaSx5R2PhrWEHn/Vbx4dAa8Luw9egma:EcKkSYdMB2haSVx4dz8d9dma
• TLSH: T151413A216B7A2466F43946C98C94453D01CE065C8E2CDFED8FCA6EE3885EE935D701E8
• Submitted as: b66b26a35de9e13a2aef100404cfd64ea4bab0cb3ddaf98a0a2d6860d1055fea.bin
• File type: elf · Size: 190924 bytes
• Verdict: malicious (94/100) · Family: Persistence

Source: MalShare · first seen 2026-10-03T06:13:27.902Z · SHA-256 verified

Detections (5 of 57 engines)

• YARA: Intezer community: INTEZER_Linux_Persistence
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Microsoft Defender: Backdoor:Linux/Mirai.CC!xp
• Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60057613
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 94/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Backdoor:Linux/Mirai.CC!xp (rule Backdoor:Linux/Mirai.CC!xp) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Linux.GenericKD.60057613 (rule Trojan.Linux.GenericKD.60057613) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.b (rule HEUR:Backdoor.Linux.Mirai.b) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_Persistence (rule INTEZER_Linux_Persistence) - engine signal, weight 0.50, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

832 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 160.119.66.206:25565 US · New York City · AS7489 HostMem
• 127.243.198.132
• 160.119.66.206 US · New York City · AS7489 HostMem
• 10.240.0.1
• ff02::16
• 185.125.190.56
• ff02::1
• ff02::2
• ff02::1:ff12:3456
• 255.255.255.255

Embedded URLs

• https://www.google.com/

Embedded domains

• www.google.com

Embedded IP addresses

• 160.119.66.206

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report