MALICIOUS — fe3593e24f31c6ec25a24014697f0f46ef3d7dc44db344ea9a1211d1e4b85daf

MALICIOUS — fe3593e24f31c6ec25a24014697f0f46ef3d7dc44db344ea9a1211d1e4b85daf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mirai family. 4 of 57 detection engines flagged it.

Identification

• SHA-256: fe3593e24f31c6ec25a24014697f0f46ef3d7dc44db344ea9a1211d1e4b85daf
• SHA-1: ee4c4660c6b9575a91653e17e78cf5d93b00aab0
• MD5: 60b7d2f0b4fbbdab675e20895e151b79
• ssdeep: 1536:G556ZVrsNCcG1/xgY2wI5WKRWewWcb0hNDKJhTEB+e4S4mTOx0wf3b:SG1jTI5+ewWcb0fKPoBv4S49f3b
• TLSH: T1A039C910BD56202BE43985CCCC590D3C368D09AC5E2CC9ABDDEA6A67454EEA73D384C7
• Submitted as: fe3593e24f31c6ec25a24014697f0f46ef3d7dc44db344ea9a1211d1e4b85daf
• File type: elf · Size: 88008 bytes
• Verdict: malicious (99/100) · Family: Mirai

Detections (4 of 57 engines)

• ClamAV (daily): Unix.Dropper.Mirai-7135944-0
• Microsoft Defender: Backdoor:Linux/Gafgyt.CD!xp
• Emsisoft (Emergency Kit): Trojan.Linux.Mirai.39413994
• Kaspersky (KVRT): HEUR:Backdoor.Linux.Gafgyt.a

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Unix.Dropper.Mirai-7135944-0 (rule Unix.Dropper.Mirai-7135944-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. injected region in x0zG0Dn3Tx (pid 696) (rule linux.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Backdoor:Linux/Gafgyt.CD!xp (rule Backdoor:Linux/Gafgyt.CD!xp) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Linux.Mirai.39413994 (rule Trojan.Linux.Mirai.39413994) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Linux.Gafgyt.a (rule HEUR:Backdoor.Linux.Gafgyt.a) - engine signal, weight 0.55, confidence 0.85
• Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
• Embedded network infrastructure: 1.9.2.14, 4.0.249.0, 8.8.8.8 - static signal, weight 0.35, confidence 0.60
• Contacted 13 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

895 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• _dosvc._tcp.local
• 193.176.29.254:23890 GB · AS25369 HYDRA-MNT
• 193.176.29.254 GB · AS25369 HYDRA-MNT
• 20.184.175.21 US · San Jose · AS8075 Microsoft Corporation
• 4.150.223.106 US · Des Moines · AS8075 Microsoft Corporation
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 10.240.0.1
• 224.0.0.251
• ff02::fb
• ff02::1:ff12:3456
• 13.69.109.131 NL · Amsterdam · AS8075 Microsoft Corporation
• 20.42.179.204 US · Moses Lake · AS8075 Microsoft Corporation

Embedded IP addresses

• 1.9.2.14
• 4.0.249.0
• 8.8.8.8
• 193.176.29.254
• 20.184.175.21
• 4.150.223.106
• 13.69.109.131
• 20.42.179.204
• 203.26.79.13
• 48.211.4.16
• 172.172.255.217
• 40.84.97.4
• 51.105.71.136
• 85.210.193.152
• 57.154.63.210

More Mirai samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report