MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c
SHA3-384 hash: f8d30911437dab44739b4954f273cdf3e9e6f4c8a4f47f604a7f5dc7f7f6eed517e593b64e3a13a3fa66767572048ded
SHA1 hash: cfa542d7177b26142ae16812d24e6a4828000648
MD5 hash: 542833382147a9aaab56ec86e0952317
humanhash: chicken-sink-video-hotel
File name:rondo.x86_64
Download: download sample
Signature Gafgyt
Create hunting rule
File size:115'832 bytes
First seen:2025-12-24 00:23:43 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:MUdQH49lXLDJLoEf01g1GyS3tGwrBrZQx:MkpoEiO14tGP
TLSH T102B3380AB4C1D9FCC869D2B45B9F7135D031F1A82130B9AE27D4BF163A9C9507F2BA85
telfhash t1d83199b418d2364c52c78759335eecb6e8b609260d5138a49f2bfde58d0bbdc0e42860
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
gafgyt mirai
Link:
https://www.filescan.io/uploads/694b32afe126b9ff438f1fb2/reports/4c09dbf1-6dcd-4d54-a5be-06bdaef4ebed/overview
Verdict:
Malicious
File Type:
elf.64.le
First seen:
2025-12-25T00:02:00Z UTC
Last seen:
2025-12-25T00:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cc38f002-40ad-47eb-8699-b37b2d4e26ac
Behavior Graph:
Download SVG
%3 guuid=3d3f9e60-1900-0000-50ec-067f670f0000 pid=3943 /usr/bin/sudo guuid=a1ac0763-1900-0000-50ec-067f740f0000 pid=3956 /tmp/sample.bin guuid=3d3f9e60-1900-0000-50ec-067f670f0000 pid=3943->guuid=a1ac0763-1900-0000-50ec-067f740f0000 pid=3956 execve
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ad2722f-5531-4b76-ba78-945167cae5f9
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1838570
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Suspicious
First seen:
2025-12-24 00:24:19 UTC
File Type:
ELF64 Little (Exe)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bevjdkhmruwhdhfsctkb6w2efh5ddw6nfh6gtdyf2iwjpqhubmga._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251224-ap75vs1mds/
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Trojan.Mirai-7640640-0
YARA:
Linux_Trojan_Gafgyt_9e9530a7 Linux_Trojan_Gafgyt_807911a2 Linux_Trojan_Gafgyt_d4227dbf Linux_Trojan_Gafgyt_d996d335 Linux_Trojan_Gafgyt_620087b9 Linux_Trojan_Gafgyt_0cd591cd Linux_Trojan_Gafgyt_33b4111a Linux_Trojan_Gafgyt_a33a8363
Link:
https://app.threat.zone/submission/d7820b2e-0f13-4d12-95cb-1562d56160d2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Trojan_Gafgyt_0cd591cd
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_33b4111a
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_620087b9
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_807911a2
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_9e9530a7
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_a33a8363
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d4227dbf
Create hunting rule
Author:Elastic Security
Rule name:Linux_Trojan_Gafgyt_d996d335
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37

Gafgyt

elf 092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3736077/
  
Delivery method
Distributed via web download
  
Dropped by
SHA256 950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37
  
Dropped by
MD5 7d2a2057e15cf2dbea78429e6c051afd
  
URLhaus
https://urlhaus.abuse.ch/url/3736083/
  
Dropped by
SHA256 628c8f319f2aec171effe37e8fad0faeab04abe09e9ff9c8db27e7de6b25a60e
  
Dropped by
MD5 52fe9bbcb486665c1ce0c75db8084569
  
Dropped by
SHA256 152e82c6383a68baeb5a453ba03c4ee910c53765ea9d93ee042af548d607add9
  
Dropped by
MD5 f472c9a409f62d3f1327ffc18fe33da9
  
Dropped by
SHA256 91c0646895d8398081351d690f1c5af75d242c13f22a80dc82fc9ae4798a4576
  
Dropped by
MD5 c156b1348b56c5ce6205cd735266ad37
  
Dropped by
SHA256 e757f9cca122d5fc5a9f6fa40c3a61addc5c641193ba7e24085d208fc6c82ec6
  
Dropped by
MD5 cbc0db96d5f4749b2166d2426ba164e2

Comments