MALICIOUS — d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1.bin

MALICIOUS — d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1.bin is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 6 of 57 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1
SHA-1: 2b1a2afa963f5dcf45696c8e3d7c9c28a67792d2
MD5: 01b534c36a2568919e58eb6a6d6220a1
ssdeep: 3072:0AVPZY+3PZpfXKU32stDVCfUNGulYS+uSp1vgz:ZZb3RpSUDtMMyN1Yz
TLSH: T1373E6C9E4254934AF3D1F9B4E06D8EED901FB49991724FE80112818CF3E580BF8676A7
Submitted as: d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1.bin
File type: elf · Size: 145548 bytes
Verdict: malicious (99/100) · Family: Mirai

Source: MalShare · first seen 2026-10-03T05:33:27.972Z · SHA-256 verified

Detections (6 of 57 engines)

ClamAV (daily): Unix.Trojan.Mirai-9866113-0
YARA: Intezer community: INTEZER_Linux_Persistence
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: Backdoor:Linux/Mirai.AU!MTB
Emsisoft (Emergency Kit): Trojan.Linux.GenericKD.60057608
Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Unix.Trojan.Mirai-9866113-0 (rule Unix.Trojan.Mirai-9866113-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Linux/Mirai.AU!MTB (rule Backdoor:Linux/Mirai.AU!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Linux.GenericKD.60057608 (rule Trojan.Linux.GenericKD.60057608) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.b (rule HEUR:Backdoor.Linux.Mirai.b) - engine signal, weight 0.55, confidence 0.85
YARA: Intezer community flagged INTEZER_Linux_Persistence (rule INTEZER_Linux_Persistence) - engine signal, weight 0.50, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Contacted 28 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

760 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

ntp.ubuntu.com
207.19.94.182:51601 US · AS701 Eaglenet, Inc.
160.119.66.206:25565 US · New York City · AS7489 HostMem
190.76.85.27:27604 VE · CANTV Servicios, Venezuela
43.121.157.109:60075 SG · AS45102 Alibaba Cloud (Singapore) Private Limited
184.223.35.154:23758 US · AS16509 Amazon.com, Inc.
21.132.16.122:14821 US · AS749 DoD Network Information Center
198.247.45.155:31235 US · AS2914 NTT America, Inc.
207.214.200.62:10242 US · AS7018 AT&T Enterprises, LLC
54.178.6.140:29867 US · AS16509 Amazon Technologies Inc.
116.111.120.102:18465 VN · Hanoi · AS7552 Viettel Group
61.27.19.151:29843 JP · AS9824 JCOM Co., Ltd.
136.90.31.92:8969 US · AS396982 Google LLC
114.8.117.0:15161 ID · INDOSAT INP Hostmaster
176.128.17.128:43893 FR · AS5410 BYTEL-MNT
207.19.94.182 US · AS701 Eaglenet, Inc.
160.119.66.206 US · New York City · AS7489 HostMem
190.76.85.27 VE · CANTV Servicios, Venezuela
10.240.0.1
43.121.157.109 SG · AS45102 Alibaba Cloud (Singapore) Private Limited

Dropped files

var_tmp_.iyh3f8O7 - d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1
var_tmp_.sys_recovery.sh - 014304f58157b371cff830181b568449bf208861c65a11bed05fb17cd30a4a7d

Embedded URLs

https://www.google.com/

Embedded domains

www.google.com

Embedded IP addresses

207.19.94.182
160.119.66.206
190.76.85.27
43.121.157.109
184.223.35.154
21.132.16.122
198.247.45.155
207.214.200.62
54.178.6.140
116.111.120.102
61.27.19.151
136.90.31.92
114.8.117.0
176.128.17.128

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report