MALICIOUS — e109c0b30c8602942c7893b0e10c8ff1da9ea7484e404e00d0c43569e9c7f12c.elf
MALICIOUS — e109c0b30c8602942c7893b0e10c8ff1da9ea7484e404e00d0c43569e9c7f12c.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.
Identification
- SHA-256:
e109c0b30c8602942c7893b0e10c8ff1da9ea7484e404e00d0c43569e9c7f12c - SHA-1:
4fe08d58ed82d94ecaeedf22e0a01a16545eb66a - MD5:
ca7a4dd2924e4646b4cb5b36c379801f - ssdeep:
3072:ZwcAOnT5luWLiO08pk8knQWAkLVzjO+JWmvEaZp78n+:ZwcAOn1l15kVRWmP/gn+ - TLSH:
T1333F7D5A426C97DAF2D0E8B1E06C4D9D605BBC5C22768FEC0216C56C77E680BA47E0C6 - Submitted as: e109c0b30c8602942c7893b0e10c8ff1da9ea7484e404e00d0c43569e9c7f12c.elf
- File type: elf · Size: 151144 bytes
- Verdict: malicious (89/100) · Family: Mirai
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (4 of 56 engines)
- ClamAV (daily): Unix.Trojan.Mirai-9441505-0
- Microsoft Defender: Backdoor:Linux/Bushido.A!xp
- Emsisoft (Emergency Kit): Trojan.Generic.40360895
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw
Why this verdict
The malicious score of 89/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-9441505-0 (rule
Unix.Trojan.Mirai-9441505-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: http://185.183.34.45/LjEZs/awsec2, http://185.183.34.45/LjEZs/vacron, http://185.183.34.45/LjEZs/netgear2 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (linux)
757 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- ntp.ubuntu.com
- self.events.data.microsoft.com
- reavercncv3.duckdns.org
- 212.157.37.38:8080 FR · AS702 IWAY-NOC
- 164.7.151.223:80 FR · MNT-LFDJ
- 63.81.0.32:8080 US · AS701 VERIZON CONNECT FLEET USA LLC
- 190.218.212.53:80 PA · AS18809 AS18809 - Cable Onda, PA
- 188.206.8.67:8080 NL · AS1136 KPN - KPN B.V., NL
- 125.140.33.122:10030 KR · Sokcho · AS4766 Korea Telecom
- 72.82.93.110:8080 US · Verizon Business
- 183.196.172.130:8080 CN · AS24547 China Mobile Communications Group Co., Ltd
- 188.206.8.67:37215 NL · AS1136 KPN - KPN B.V., NL
- 63.81.0.32:37215 US · AS701 VERIZON CONNECT FLEET USA LLC
- 183.196.172.130:37215 CN · AS24547 China Mobile Communications Group Co., Ltd
Embedded URLs
- http://185.183.34.45/LjEZs/awsec2
- http://185.183.34.45/LjEZs/vacron
- http://185.183.34.45/LjEZs/netgear2
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- http://185.183.34.45/LjEZs/dlink
- http://185.183.34.45/LjEZs/jaws
- http://185.183.34.45/LjEZs/crossweb
- http://purenetworks.com/HNAP1/
- http://185.183.34.45/LjEZs/hnap
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2001/XMLSchema
- http://185.183.34.45/LjEZs/tr064
- http://185.183.34.45/LjEZs/netgear+-O+/tmp/netgear
- http://185.183.34.45/LjEZs/realtek
- http://185.183.34.45/LjEZs/gpon80+-O+-
- http://185.183.34.45/LjEZs/gpon8080+-O+-
- http://217.60.195.187/sshex.sh
Embedded domains
- 255.net
- stresser.pw
- schemas.xmlsoap.org
- purenetworks.com
- www.w3.org
- discord.com
- osboxes.org
- sshex.sh
- example.com
- www.ovh.com
- cloud.service.net
- reavercncv3.duckdns.org
Embedded IP addresses
- 185.183.34.45
- 192.168.0.100
- 176.32.33.88
- 217.60.195.187
- 212.157.37.38
- 183.196.172.130
- 188.206.8.67
- 63.81.0.32
- 72.82.93.110
- 78.131.137.182
- 204.177.156.246
- 164.7.151.223
- 190.218.212.53
- 125.140.33.122
- 101.208.56.226
- 74.178.76.44
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report