MALICIOUS — df6aebba76962f8ef44da15f929d0f25e7af8428a009f26e2e081435bd912a9b.elf

MALICIOUS — df6aebba76962f8ef44da15f929d0f25e7af8428a009f26e2e081435bd912a9b.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: df6aebba76962f8ef44da15f929d0f25e7af8428a009f26e2e081435bd912a9b
• SHA-1: 660f22cd2c472a387787f46369dabde1bbe87569
• MD5: d449dcec12245e1057c74aeebdee7db9
• ssdeep: 1536:jIODpMBfPHVlTJAkw4TvFQLPXsWfeeIF+5yryD/Fhqs/n+5:kqeNhJAoENeeIY5Ly5
• TLSH: T1F2373A5BB9B7B8A8C67D3789B42B4FBEA5162855143C3F6CD31A1F2964BB0332631401
• Submitted as: df6aebba76962f8ef44da15f929d0f25e7af8428a009f26e2e081435bd912a9b.elf
• File type: elf · Size: 73292 bytes
• Verdict: malicious (93/100) · Family: Mirai

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Dropper.Mirai-7135957-0
• Microsoft Defender: Backdoor:Linux/Mirai.EO!MTB
• Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.b

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Unix.Dropper.Mirai-7135957-0 (rule Unix.Dropper.Mirai-7135957-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 2 finding(s), e.g. injected region in 0iop6h3vuoiq (pid 687) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

829 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• 94.154.43.115:18129 GB · London · AS208485 SUNUCUN BILGI ILETSIM TEKNOLOJILERI VE TICARET LIMITED SIRKETI
• ff02::1:3
• 224.0.0.252
• 94.154.43.115 GB · London · AS208485 SUNUCUN BILGI ILETSIM TEKNOLOJILERI VE TICARET LIMITED SIRKETI
• 10.240.0.1
• 89.238.68.201 DE · Dresden · AS34240 The Document Foundation
• 20.190.142.167
• 10.240.0.255
• ff02::fb
• 224.0.0.251
• 52.168.117.168 US · Chantilly · AS8075 Microsoft Corporation
• ff02::16
• 20.42.73.25 US · Ashburn · AS8075 Microsoft Corporation

Embedded IP addresses

• 94.154.43.115
• 89.238.68.201
• 52.168.117.168
• 20.42.73.25
• 20.184.175.5
• 172.215.188.225
• 20.42.73.28
• 57.155.101.212
• 72.153.5.141
• 20.184.175.15

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report