MALICIOUS — c08f60a2df802395b9eff8d2d1cdfa31cef1812bad5d4803c48bf76133b94402.elf
MALICIOUS — c08f60a2df802395b9eff8d2d1cdfa31cef1812bad5d4803c48bf76133b94402.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mirai family. 4 of 53 detection engines flagged it.
Identification
- SHA-256:
c08f60a2df802395b9eff8d2d1cdfa31cef1812bad5d4803c48bf76133b94402 - SHA-1:
e6ad8ac5eed114eed6e751ea72fbe7be89c33f98 - MD5:
fe8bc08a7ccc66b52f7e72fde823afec - ssdeep:
3072:QzJ/7gClGlzUOTfmKYqRayxxxOzkCKvJ0c+epg:U7gCEk4xxOzkCoaclpg - TLSH:
T18F416D1BA8B7F8A8C57E3585A42B0F7E611619DD50787F5CD32C4B1899AF4B32E32408 - Submitted as: c08f60a2df802395b9eff8d2d1cdfa31cef1812bad5d4803c48bf76133b94402.elf
- File type: elf · Size: 190712 bytes
- Verdict: malicious (89/100) · Family: Mirai
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (4 of 53 engines)
- ClamAV (daily): Unix.Dropper.Mirai-7135957-0
- Microsoft Defender: Backdoor:Linux/Bushido.A!xp
- Emsisoft (Emergency Kit): Gen:Variant.Linux.DDoS.2
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw
Why this verdict
The malicious score of 89/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Unix.Dropper.Mirai-7135957-0 (rule
Unix.Dropper.Mirai-7135957-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: http://185.183.34.45/LjEZs/awsec2, http://185.183.34.45/LjEZs/vacron, http://185.183.34.45/LjEZs/netgear2 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (linux)
868 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- ntp.ubuntu.com
- 255.255.254.169.in-addr.arpa
- 251.0.0.224.in-addr.arpa
- ff02::1:3
- 224.0.0.252
- 224.0.0.251
- ff02::fb
- 169.254.255.255
- 10.240.0.1
- 10.240.0.255
- 185.125.190.56
- ff02::1
Embedded URLs
- http://185.183.34.45/LjEZs/awsec2
- http://185.183.34.45/LjEZs/vacron
- http://185.183.34.45/LjEZs/netgear2
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://185.183.34.45/LjEZs/dlink
- http://185.183.34.45/LjEZs/jaws
- http://185.183.34.45/LjEZs/crossweb
- http://purenetworks.com/HNAP1/
- http://185.183.34.45/LjEZs/hnap
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
- http://185.183.34.45/LjEZs/tr064
- http://185.183.34.45/LjEZs/netgear+-O+/tmp/netgear
- http://185.183.34.45/LjEZs/realtek
- http://185.183.34.45/LjEZs/gpon80+-O+-
- http://185.183.34.45/LjEZs/gpon8080+-O+-
- http://217.60.195.187/sshex.sh
Embedded domains
- 255.net
- stresser.pw
- schemas.xmlsoap.org
- purenetworks.com
- www.w3.org
- discord.com
- sshex.sh
- osboxes.org
- example.com
- www.ovh.com
- cloud.service.net
Embedded IP addresses
- 185.183.34.45
- 192.168.0.100
- 176.32.33.88
- 217.60.195.187
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report