Report Overview
Visitedpublic
2024-10-31 02:20:37
Tags
Submit Tags
urlhaus
URL
117.209.122.134:40234/bin.sh
Finishing URL
about:privatebrowsing
IP / ASN
117.209.122.134
#9829 National Internet Backbone
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
0

Host Summary

HostRankRegisteredFirst SeenLast Seen
117.209.122.134
unknownunknownNo dataNo data
aus5.mozilla.org
25481998-01-242015-10-272024-10-30

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

SeveritySource IPDestination IPAlert
high
117.209.122.134
Client IPET POLICY Executable and linking format (ELF) file download

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
medium117.209.122.134:40234/bin.shDetects a suspicious ELF binary with UPX compression
medium117.209.122.134:40234/bin.shLinux.Packer.Patched_UPX

OpenPhish

No alerts detected


PhishTank

No alerts detected


Mnemonic Secure DNS

No alerts detected


Quad9 DNS
SeverityIndicatorAlert
medium117.209.122.134Sinkholed

ThreatFox

No alerts detected


File detected

URL
117.209.122.134:40234/bin.sh
IP / ASN
117.209.122.134
#9829 National Internet Backbone
File Overview
File TypeELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV)
Size136 kB (135784 bytes)
MD559ce0baba11893f90527fc951ac69912
SHA15857a7dd621c4c3ebb0b5a3bec915d409f70d39f

Detections

AnalyzerVerdictAlert
Public Nextron YARA rulesmalware
Detects a suspicious ELF binary with UPX compression
Elastic Security YARA Rulesmalware
Linux.Packer.Patched_UPX
VirusTotalmalicious
VirusTotal - Scan result 48/64
ClamAVmalicious
Unix.Trojan.Mozi-9840825-0

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize