CLEAN — b9a96066856f30c4d0e54547d8420957d79e493e32ea5792504dc065da8801d3.elf

CLEAN — b9a96066856f30c4d0e54547d8420957d79e493e32ea5792504dc065da8801d3.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 2 of 56 detection engines flagged it.

Identification

• SHA-256: b9a96066856f30c4d0e54547d8420957d79e493e32ea5792504dc065da8801d3
• SHA-1: eb35b3606116a8d5f726f5bf8fd718c0fef5901d
• MD5: 46c596d7f780f87054d3a4d5e3db57d9
• ssdeep: 48:Oji5E4GYg2HyK1eHeu/9LuEpEon3weBl:956WHfCMEpEs3Ll
• TLSH: T16C14F18BF3335919F7B8D81560322EDD52D9168951B4443E130709A871B792F0F2FA6A
• Submitted as: b9a96066856f30c4d0e54547d8420957d79e493e32ea5792504dc065da8801d3.elf
• File type: elf · Size: 2000 bytes
• Verdict: clean (0/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (2 of 56 engines)

• Emsisoft (Emergency Kit): Trojan.Generic.40356702
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Linux.Mirai.d

Dynamic analysis (linux)

904 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• 250.255.255.239.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• ff02::1:3
• 224.0.0.252
• ff02::fb
• 224.0.0.251
• 10.240.0.1
• 10.240.0.255
• 255.255.255.255
• 239.255.255.250
• ff02::16
• 4.150.223.108 US · Des Moines · AS8075 Microsoft Corporation
• 185.125.190.57
• 4.150.223.110 US · Des Moines · AS8075 Microsoft Corporation
• 20.165.94.63 US · San Antonio · AS8075 Microsoft Corporation

Embedded IP addresses

• 4.150.223.108
• 4.150.223.110
• 20.165.94.63
• 52.182.141.63

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report