MALICIOUS — fb12ac6a790eb3d92a483863208a83665547f2354a7e1aac02785f3234e29ad7.elf

MALICIOUS — fb12ac6a790eb3d92a483863208a83665547f2354a7e1aac02785f3234e29ad7.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mirai family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: fb12ac6a790eb3d92a483863208a83665547f2354a7e1aac02785f3234e29ad7
• SHA-1: f4d5c0bcf827609a0fad9506fb415f5f9a48ae4c
• MD5: 571985ecdf04d0211fcbde7669461733
• ssdeep: 3072:uOC7LF7Kx+pPwSXVt4u9p9i5f9w4sbUVwjbiHLwhyqRWb7nygxdCAF/3:w8Slt4u9p90f1sbGLwhyqRO7nygHCQ/3
• TLSH: T14C402ACAFD762C04E3B858D850F3052EC794161F849EBB39415B26E55FAA70382BDA43
• Submitted as: fb12ac6a790eb3d92a483863208a83665547f2354a7e1aac02785f3234e29ad7.elf
• File type: elf · Size: 175200 bytes
• Verdict: malicious (89/100) · Family: Mirai

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

• ClamAV (daily): Unix.Trojan.Mirai-6981989-0
• Microsoft Defender: Backdoor:Linux/Mirai.AM!xp
• Emsisoft (Emergency Kit): Trojan.Linux.Mirai.1
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Mirai.cw

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Unix.Trojan.Mirai-6981989-0 (rule Unix.Trojan.Mirai-6981989-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: 94.154.43.237 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (linux)

812 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• 255.255.254.169.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• desktop-hsgcbep
• 250.255.255.239.in-addr.arpa
• 199.232.138.172
• 20.190.167.64
• ff02::1:3
• 224.0.0.252
• 224.0.0.251
• 169.254.255.255
• 239.255.255.250
• 10.240.0.1
• ff02::16
• 10.240.0.255
• ff02::fb
• 4.150.223.106 US · Des Moines · AS8075 Microsoft Corporation

Embedded domains

• example.com

Embedded IP addresses

• 94.154.43.237
• 4.150.223.106

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report