MALICIOUS — d86694d1cbdf7af6d65e8c362ab68b3bd18a6d6a5d882416704c2409e87e1b1e.elf

MALICIOUS — d86694d1cbdf7af6d65e8c362ab68b3bd18a6d6a5d882416704c2409e87e1b1e.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Mirai family. 5 of 56 detection engines flagged it.

Identification

• SHA-256: d86694d1cbdf7af6d65e8c362ab68b3bd18a6d6a5d882416704c2409e87e1b1e
• SHA-1: 74da7f7adb87cac8fb5a93adee5536b29689f1b3
• MD5: d1d9c26eaf3d22b3c80ae8fd92e1b469
• ssdeep: 3072:08iN7p8KcnM5NcN4IV6OZzrjU7GDCCgptWsRCGq:Yt8VnMvcN1Rdnq6PGq
• TLSH: T1243B29A65349A38ADBE0E4F9F0AC1F2D2083BC89A1738FDC8583458C73E59979C545D2
• Submitted as: d86694d1cbdf7af6d65e8c362ab68b3bd18a6d6a5d882416704c2409e87e1b1e.elf
• File type: elf · Size: 111892 bytes
• Verdict: malicious (90/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-7100807-0
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Microsoft Defender: Backdoor:Linux/Mirai.BJ!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Linux.DDoS.2
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw

Why this verdict

The malicious score of 90/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-7100807-0 (rule Unix.Trojan.Mirai-7100807-0) - engine signal, weight 0.90, confidence 0.95
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
• Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

239 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• wqok85qtq.net
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• 31.56.209.153:69 GB · London · AS25369 AE-GOLDIP
• ff02::1:3
• 224.0.0.252
• 31.56.209.153 GB · London · AS25369 AE-GOLDIP
• ff02::fb
• 224.0.0.251
• 8.8.8.8
• 41.216.189.108 DE · Frankfurt am Main · AS211138 Private-Hosting di Cipriano Oscar
• 169.254.255.255
• 10.240.0.255
• 4.150.223.98 US · Des Moines · AS8075 Microsoft Corporation
• 10.240.0.1

Embedded domains

• wqok85qtq.net

Embedded IP addresses

• 31.56.209.153
• 41.216.189.108
• 4.150.223.98
• 74.178.76.128
• 20.184.175.14
• 135.232.92.34
• 20.42.73.30
• 51.116.246.106

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report