MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35747818c8b849ec82e99ac6c4fbc5da661590fc52b7fedd1a6027f7837ae0d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	35747818c8b849ec82e99ac6c4fbc5da661590fc52b7fedd1a6027f7837ae0d7
SHA3-384 hash:	fd6224a77b398416aa438fd208198b31da64fa22f7ec3806b55e05d6564f23340957f8e136b5e90388cab3d3d7993d28
SHA1 hash:	2bfe089d1220e976aab6f367fb77d448a21c3941
MD5 hash:	2c024968256b3931670986b159f934bc
humanhash:	white-blossom-tango-indigo
File name:	89.32.41.95-arm-2024-09-03T15:01:07
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	162'464 bytes
First seen:	2024-09-03 12:10:36 UTC
Last seen:	2024-09-03 13:10:45 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:V7baHQuHMwfBLxyc4AJgbACzlQAdDHAD3PNTTDGZkY5oXKs8XO2qATAOiYl6YAwC:tuHTswfB1LslQKAzNTXGK8oX1ofyN1
TLSH	T12BF31A45FC519F26C6D212BBFB4E428D371A07A8D3EE7203C9255F20379A96B0E77642
telfhash	t13af05c71bf850dac1ae554aa8096f1b117bd30ba63352c14810d1f1ecc47d88b13901d
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	threatquery
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.Gafgyt-9939811-0

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug lolbin mirai remote

Link:

https://www.filescan.io/uploads/66d6fcd65bc1792389bc995a/reports/acbfc55d-59a9-40ab-919b-b4fa92aef216/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5a7814ed-6edb-4b15-98fa-1d0e8e05fde3

Result

Threat name:

Gafgyt

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1503390

Signature

Antivirus / Scanner detection for submitted sample

Deletes system log files

Manipulation of devices in /dev

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/35747818c8b849ec82e99ac6c4fbc5da661590fc52b7fedd1a6027f7837ae0d7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/35747818c8b849ec82e99ac6c4fbc5da661590fc52b7fedd1a6027f7837ae0d7/

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2024-09-03 11:18:16 UTC

File Type:

ELF32 Little (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gv2hqggixbe6zaxjtldmj66f3jtbleh4kk375xi2mat7pa324dlq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/240903-pclhnawcrn/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/35747818c8b849ec82e99ac6c4fbc5da661590fc52b7fedd1a6027f7837ae0d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.