MALICIOUS — d67edc48b43fc48a0b399d5144bb5d3d0862e77065117fe10f7822a70daa1d96.elf
MALICIOUS — d67edc48b43fc48a0b399d5144bb5d3d0862e77065117fe10f7822a70daa1d96.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.
Identification
- SHA-256:
d67edc48b43fc48a0b399d5144bb5d3d0862e77065117fe10f7822a70daa1d96 - SHA-1:
89a6132d864b4b1c3b2ea677f3b13dff83d59d27 - MD5:
0ffe3f1d758e5f29323b1e7e978c3ab2 - ssdeep:
3072:M6iSdcPSM+K2hwDAbHbDtYbBIeEW+9i9rYK6brE+BSF73:viSdcPSLASY+9BPCV3 - TLSH:
T17D407D6403177602D1B6DE45F4157DFDE4A7B08DA2325ACEC11B820E629C63BBCE90DA - Submitted as: d67edc48b43fc48a0b399d5144bb5d3d0862e77065117fe10f7822a70daa1d96.elf
- File type: elf · Size: 166776 bytes
- Verdict: malicious (90/100) · Family: Mirai
Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified
Detections (4 of 56 engines)
- ClamAV (daily): Unix.Dropper.Mirai-7135897-0
- Microsoft Defender: Backdoor:Linux/Mirai.AM!xp
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.7
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw
Why this verdict
The malicious score of 90/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Unix.Dropper.Mirai-7135897-0 (rule
Unix.Dropper.Mirai-7135897-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: 94.154.43.237 - static signal, weight 0.35, confidence 0.60
- Contacted 13 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
862 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep._dosvc._tcp.local
- _dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- 94.154.43.237:31339 GB · London · AS208485 SUNUCUN BILGI ILETSIM TEKNOLOJILERI VE TICARET LIMITED SIRKETI
- 0.82.241.80
- ff02::1:3
- 224.0.0.252
- 94.154.43.237 GB · London · AS208485 SUNUCUN BILGI ILETSIM TEKNOLOJILERI VE TICARET LIMITED SIRKETI
- 172.172.255.217 US · Ashburn · AS8075 Microsoft Limited
- 10.240.0.1
- ff02::fb
- 224.0.0.251
- ff02::16
Embedded domains
- example.com
Embedded IP addresses
- 94.154.43.237
- 172.172.255.217
- 72.145.35.100
- 57.155.101.212
- 203.26.79.13
- 74.179.71.159
- 20.42.65.84
- 74.179.77.204
- 57.154.63.210
- 135.233.95.80
- 20.42.179.192
- 20.184.175.8
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report