Avast detects as ELF:Mirai-ADQ [Trj]

Viruses and worms
1

Google Safebrowsing has it as malicious.

See: https://urlhaus.abuse.ch/url/160880/
See: https://urlscan.io/result/fd5a1f0e-d220-4329-a8e5-256f15c736ee
On domain: https://www.virustotal.com/#/domain/vampwrotesatori.cf
On file HTTP response: https://www.virustotal.com/#/url/cdefc7f6dd702e52721502354dd7ef489fadca4cafc42b61981006aee8ea2915/details
Re: ELF:Mirai-ADQ [Trj] → https://www.virustotal.com/nl/file/9f52f65dc02c31b422527e108108a6ec06c1347055a86a420dd283cd697e4cfb/analysis/1552795448/

Detected also at : https://tracker.h3x.eu/ and at Prof. Dr. Dietrich’s site: https://chrisdietri.ch/files/iotsamples.html

polonus

2

Another example on such bad network scanning activity:
Re: https://urlhaus.abuse.ch/url/160973/
Re Internet scanner - vulnerabilities: https://www.shodan.io/host/185.22.154.153
Reported thrice and recently active: https://www.abuseipdb.com/check/185.22.154.153

No uri detection here: https://www.virustotal.com/#/url/6aa1a139569815f50fd4f20c5ce6fcb143c38a27f8eb31de29425445ed6a4daf/detection
But avast has it covered here: https://www.virustotal.com/#/file/301427fa5807a9244e097c1dc849eac241f031b7249d3cdf3500ec5608a78259/detection

Avast detects ELF:Mirai-GH [Trj]

polonus