MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec
SHA3-384 hash: 0e700cbda3b08b3126fa0b8c729cd062cda526a43c9ecfbdfcfb75ae06528e23e025717cf979ea15a7a65a2a03073b36
SHA1 hash: 15a7978f78ca1414f485ccb3da16b86855d864a1
MD5 hash: c04821768e60f8c8f119e5997dcf5562
humanhash: mirror-ack-network-freddie
File name:arm
Download: download sample
Signature Gafgyt
Create hunting rule
File size:49'816 bytes
First seen:2021-10-18 21:00:06 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:TdV2Uh5NDS1h1/hyrxT3B31/m+uNp44nR:Td7h5dSppUxF3k+SnR
TLSH T1DC23F13584C850B5E6AF1C72FB224E4D5A2A37D76E53E6414148024D3AF6053AFFAA87
telfhash t1a2900219f4ad184c17d203110014129ad8d03464249023641f60399d509da8733878b4
Reporter tolisec
Tags:gafgyt

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.DarkNexus-7679166-0
Create hunting rule

Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
custom
Botnet:
45.95.169.115:80/StableBins
Number of open files:
4
Number of processes launched:
4
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec
Behaviour
Process Renaming
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/421de566-9527-4fcd-9a35-52eb8a1873b9
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/872675
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 21:00:19 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211018-zterjsefh7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1693403/
  
Delivery method
Distributed via web download

Comments