MALICIOUS — f38943d7da545cbb1771b7934a42e2ee9677986d671d12896b18235ebb894394.elf

MALICIOUS — f38943d7da545cbb1771b7934a42e2ee9677986d671d12896b18235ebb894394.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: f38943d7da545cbb1771b7934a42e2ee9677986d671d12896b18235ebb894394
• SHA-1: d6183438b6546a676742b4c0761dc6398d529105
• MD5: a4f0e91461b5bee890b1fa320346ffa9
• ssdeep: 3072:eq0AsDTvciQzHFBtcS/tfFu7y9cEwDIklS:J6TeH3tdqy9JwDIUS
• TLSH: T1EE42D557B3B20500E2E52910692289CE77F236DD71BCACB6031211BE61A7C4F5E3DE96
• Submitted as: f38943d7da545cbb1771b7934a42e2ee9677986d671d12896b18235ebb894394.elf
• File type: elf · Size: 210264 bytes
• Verdict: malicious (89/100) · Family: Mirai

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Dropper.Mirai-7135897-0
• Microsoft Defender: Backdoor:Linux/Mirai.AM!xp
• Emsisoft (Emergency Kit): Trojan.Generic.40355983
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Unix.Dropper.Mirai-7135897-0 (rule Unix.Dropper.Mirai-7135897-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: 94.154.43.237 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (linux)

854 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• 127.243.197.60
• 0.71.122.16
• ff02::1:3
• 224.0.0.252
• 172.172.255.218 US · Ashburn · AS8075 Microsoft Limited
• 10.240.0.255
• 10.240.0.1
• 224.0.0.251
• ff02::fb
• 150.171.110.145
• 239.255.255.250
• 185.125.190.56
• 135.233.95.80 US · Des Moines · AS8075 Microsoft Limited

Embedded domains

• example.com

Embedded IP addresses

• 94.154.43.237
• 172.172.255.218
• 135.233.95.80
• 20.42.73.28
• 4.150.223.97
• 20.184.175.5

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report