MALICIOUS — f2e9f305e05240b83c7641047e7aedc13e60d5752b2f0457fc011e3abc0766d7
MALICIOUS — f2e9f305e05240b83c7641047e7aedc13e60d5752b2f0457fc011e3abc0766d7 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.
Identification
- SHA-256:
f2e9f305e05240b83c7641047e7aedc13e60d5752b2f0457fc011e3abc0766d7 - SHA-1:
c492f06b0682c9983645faaa0dc7d01f0fe84b06 - MD5:
722e09e8bd6d3598d6d8b0113248a7b3 - ssdeep:
1536:k+hMXfgPyFdPdZ+cCRF0s71/fzRMIVITvsFmdjh:k136lMIVav5l - TLSH:
T19B37395F74B7B868D13DB68AE42A0FBE7506399410743F6CD3092B5EA4BB9772631400 - Submitted as: f2e9f305e05240b83c7641047e7aedc13e60d5752b2f0457fc011e3abc0766d7
- File type: elf · Size: 76236 bytes
- Verdict: malicious (98/100) · Family: Mirai
Detections (4 of 56 engines)
- ClamAV (daily): Unix.Trojan.Mirai-7135937-0
- Microsoft Defender: Backdoor:Linux/Mirai.BL!xp
- Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.dx
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-7135937-0 (rule
Unix.Trojan.Mirai-7135937-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Mirai.BL!xp (rule
Backdoor:Linux/Mirai.BL!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Linux.Mirai.1 (rule
Trojan.Linux.Mirai.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Mirai.dx (rule
HEUR:Backdoor.Linux.Mirai.dx) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 107.174.241.209 - static signal, weight 0.35, confidence 0.60
- Contacted 994 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
427 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- ntp.ubuntu.com
- 1.227.130.60 KR · AS9318 IP Manager
- 67.248.150.217
- 121.35.191.61 CN · AS4134 Chinanet Hostmaster
- 2.233.211.157
- 184.3.141.237
- 109.85.119.222 DE · AS3209 MMO-MNT
- 20.58.14.118
- 81.120.233.181
- 53.70.131.230
- 79.107.235.235
- 103.203.154.117 SG · AS134842 PGAS TELECOMMUNICATIONS INTERNATIONAL PTE. LTD
- 156.66.120.171
- 61.249.10.205
- 85.238.189.139
- 223.128.173.29
- 87.140.96.129
- 74.19.25.102
- 108.80.38.77 US · AS7018 AT&T Enterprises, LLC
- 74.255.237.193
Embedded IP addresses
- 107.174.241.209
- 1.227.130.60
- 67.248.150.217
- 121.35.191.61
- 2.233.211.157
- 184.3.141.237
- 109.85.119.222
- 20.58.14.118
- 81.120.233.181
- 53.70.131.230
- 79.107.235.235
- 103.203.154.117
- 156.66.120.171
- 61.249.10.205
- 85.238.189.139
- 223.128.173.29
- 87.140.96.129
- 74.19.25.102
- 108.80.38.77
- 74.255.237.193
- 217.140.173.125
- 170.134.47.189
- 202.71.35.180
- 73.178.252.17
- 75.99.47.30
More Mirai samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report