Classification: Malicious
exp.so is a trojan (Linux ELF executable, 43.3 KB). Flagged by 43% of antivirus engines (27 detections). Linked to Kinsing malware.
Detection summary
- 27 antivirus detections (43% detection ratio)
- 0 IDS alerts
- 1 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Kinsing |
ThreatFox Abuse.ch |
2026-10-08 13:40:02 |
2026-10-08 14:25:05 |
|
S0599 Kinsing
|
| Kinsing |
MalwareBazaar Abuse.ch |
2026-10-07 16:48:37 |
2026-10-07 16:48:37 |
malicious-activity
|
S0599 Kinsing
|
| Generic Malware |
Hybrid-Analysis |
2023-02-13 20:19:30 |
2023-02-13 20:19:30 |
|
|
Sample information
- Filenames
- exp.so
- File type
- ELF 64-bit LSB shared object, x86-64, version 1 (S ...
- Size
- 44320 bytes
- MD5
708db30d5e8489f5243f025cdbdc16c2
- SHA-1
78e6731430c3e4eb96cfd790b2e7820a04ebae92
- SHA-256
cf4c6ac09be225112faaef95316a137eff30e91c0f5f8e7aaf0a4bcc6c76f477
- First indexed
- 2023-02-13 20:10:32
- Last updated
- 2026-10-08 15:07:51
Antivirus detections
| Engine | Detection |
| Lionic | Trojan.Linux.Linux.4!c |
| MicroWorld-eScan | Trojan.Linux.Generic.257813 |
| ALYac | Trojan.Linux.Generic.257813 |
| Symantec | Trojan.Gen.NPE |
| ESET-NOD32 | a variant of Linux/Getshell.BN |
| TrendMicro-HouseCall | TROJ_GEN.R002C0PIS22 |
| Avast | ELF:Agent-BXE [Trj] |
| Kaspersky | HEUR:Backdoor.Linux.Agent.du |
| BitDefender | Trojan.Linux.Generic.257813 |
| Tencent | Linux.Backdoor.Agent.Ocnw |
| Emsisoft | Trojan.Linux.Generic.257813 (B) |
| DrWeb | Linux.BtcMine.361 |
| VIPRE | Trojan.Linux.Generic.257813 |
| TrendMicro | TROJ_GEN.R002C0PIS22 |
| McAfee-GW-Edition | RDN/Generic.dx |
| FireEye | Trojan.Linux.Generic.257813 |
| Ikarus | Trojan.Linux.Getshell |
| GData | Trojan.Linux.Generic.257813 |
| Antiy-AVL | Trojan[Backdoor]/Linux.GetShell.bn |
| Microsoft | Trojan:Linux/Multiverze |
| Arcabit | Trojan.Linux.Generic.D3EF15 |
| ZoneAlarm | HEUR:Backdoor.Linux.Agent.du |
| Google | Detected |
| McAfee | RDN/Generic.dx |
| MAX | malware (ai score=82) |
| Rising | Backdoor.Agent/Linux!8.133D0 (CLOUD) |
| AVG | ELF:Agent-BXE [Trj] |
Process list
| Name | Command line |
| exp.so.elf | |