- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
96e1ec8a521e259d0392e845560d65d997cdcfd4ac8071b9c4585e91d5f25a3b- SHA1
8091f9091aaf8a49678a73c4379fb54c8ee4a847- MD5
770030e0f324f96d0597d37fabff37bb- Filename
- 96e1ec8a_splmips.elf.bin
- File type
- elf
- MIME
- application/x-elf
- File size
- 152128
- TLSH
T1A7E3C80F7E629F6DF728C2344BB78B35A75523D223E0C585D2ACEA015E6024E586FF94- SSDEEP
1536:GWL4rvWN4RHy+Ii52i5nX5qywImJc7OE801t2dH2RP6VxIPRoYgPQW+HOee930KD:GByN9+VwID8vGiVPYgP/+OUE6fw
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 43%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections43%
VirusSign confidence100%
Relationship context10 visible
Threat classificationmirai
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
2shown
0%
mz
8 bytes
contains
Filename
72a4fa35_tutorial061_us.win32.imgb.bin
File type
mz
MIME
application/octet-stream
Size
8
SHA1
ce296b184763a332aca5193149245ab4653334e8
0%
4 bytes
contains
Filename
df3f6198_.init_array.bin
MIME
application/octet-stream
Size
4
SHA1
9069ca78e7450a285173431b3e52c5c25299e473
First seen
2006-12-13T01:02:57Z
Related IPs
Network IPs associated with this indicator.
5shown
5%
low
XK
communicates
CIDR
178.175.0.0/17
Network
178.175.64.0-178.175.127.255
First seen
2023-12-16T18:55:57Z
Last seen
2026-11-12T22:01:09Z
5%
low
RO
communicates
CIDR
85.122.114.0/24
Network
85.122.114.0-85.122.114.255
First seen
2026-02-02T09:20:29Z
Last seen
2026-11-14T01:31:20Z
DE
communicates
CIDR
178.0.0.0/12
Network
178.10.128.0-178.10.255.255
First seen
2026-11-11T20:34:45Z
Last seen
2026-11-14T01:31:16Z
JP
communicates
CIDR
202.42.45.0/24
Network
202.42.45.0-202.42.45.255
First seen
2026-11-01T17:27:13Z
Last seen
2026-11-14T01:31:15Z
0%
RU
communicates
CIDR
109.168.224.0/19
Network
109.168.192.0-109.168.255.255
First seen
2023-10-05T21:43:06Z
Last seen
2026-11-12T22:01:09Z
Related domains
Domains associated with this indicator.
2shown
Related URLs
URLs associated with this indicator.
1shown
41%
high
communicates
HTTP status
404
Content length
10
Content SHA256
7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6
First seen
2026-11-10T05:03:26Z
Last seen
2026-11-14T14:00:50Z
Analysis details
Severity: hightrojanelfmiraitoriidownloaderservice-scantelnet
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 43%
- Threat type
- trojan
- Family
- mirai
- Confidence
- 100%
- detection
- 43 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
96e1ec8a521e259d0392e845560d65d997cdcfd4ac8071b9c4585e91d5f25a3b- SHA1
8091f9091aaf8a49678a73c4379fb54c8ee4a847- MD5
770030e0f324f96d0597d37fabff37bb- Filename
- 96e1ec8a_splmips.elf.bin
- File type
- elf
- MIME
- application/x-elf
- File size
- 152128
- TLSH
T1A7E3C80F7E629F6DF728C2344BB78B35A75523D223E0C585D2ACEA015E6024E586FF94- SSDEEP
1536:GWL4rvWN4RHy+Ii52i5nX5qywImJc7OE801t2dH2RP6VxIPRoYgPQW+HOee930KD:GByN9+VwID8vGiVPYgP/+OUE6fw- First seen
- 2026-11-12T17:23:29Z
- Last seen
- 2026-11-12T22:02:35Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 43%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family mirai.
Relationship context
10 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 2006-12-13 to 2026-11-12. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family mirai.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 96e1ec8a_splmips.elf.bin
- File type
- elf
- MIME
- application/x-elf
- Size
- 152128
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View MITRE ATT&CK details · 1 shown
- T1046 — Network portsweepTactics: TA0007
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTPports 23, 53, 40059
- 5+ outbound connections observed
- 1 domains, 5+ IPs, 2 URLs
- Common ports: 23, 53, 40059, 80
- Protocols: HTTP
View details · 5 shown
- Domain
- 45.90.163.37
- URL
- http://45.90.163.37/b2
- Protocol
- HTTP
- IP
- 45.90.163.37
- Port
- 80
- IP
- 85.122.114.16
- Port
- 40059
- IP
- 178.175.122.112
- Port
- 23
- Domain
- 45.90.163.37
- URL
- http://45.90.163.37:80/b2
- Protocol
- HTTP
5 shown
DNS request activity2
A2 response IPs
- 2 DNS requests observed
- 2 unique queries
- 2 response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- lkol.dyn
- Type
- A
- Answers
- 178.10.252.73
- Response
- NOERROR
- Query
- bigr.dyn
- Type
- A
- Answers
- 202.42.45.124
- Response
- NOERROR