MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b52f8ff47eb676662dc0b019eb4183a356be94add3f71bc1a86df99ce9ecaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments 1

SHA256 hash:	45b52f8ff47eb676662dc0b019eb4183a356be94add3f71bc1a86df99ce9ecaf
SHA3-384 hash:	77e1c771fccedc8eb3cc012355902affc719c07f5a428d107bedafb952c61e8926bdd56c28b22363777207778250d601
SHA1 hash:	a79d65c0db06cf35048a62476c88c9f5fa4a1f98
MD5 hash:	926f0dbefed095b60b918f30b0161af1
humanhash:	bravo-asparagus-fourteen-snake
File name:	926f0dbefed095b60b918f30b0161af1
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	162'528 bytes
First seen:	2024-04-08 00:15:30 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:2EUUj8jgfPPH+SxxqnP4gB8bt4VEWpJVmSQz6:QUjbfeSb+P4gubtkEW3VmSC6
TLSH	T1C5F31885F8509F26C6D3267BFB4E428D371A0768D3EE720399259F25378A9AB0E37141
telfhash	t1c3f0ab94ebd81e8c6ef8484a51d7e133013eb00827011ca7abb60acbceb25d9f10c01e
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash lolbin php remote

Link:

https://www.filescan.io/uploads/66133745f57432632ba4142b/reports/0b2db243-9ad7-414f-9aa0-2d89c6366799/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/26960a1f-3567-42c8-868b-c40226ad19c8

Result

Threat name:

Gafgyt, Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1421906

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/45b52f8ff47eb676662dc0b019eb4183a356be94add3f71bc1a86df99ce9ecaf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/45b52f8ff47eb676662dc0b019eb4183a356be94add3f71bc1a86df99ce9ecaf/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-04-08 00:16:05 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iw2s7d7up23hmzrnycybt22bqorvnpuuvxj7og6bvbw7thhj5sxq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

discovery

Link:

https://tria.ge/reports/240408-akf6ksba75/

Behaviour

Reads runtime system information

Enumerates running processes

Changes its process name

Deletes itself

Traces itself

Unexpected DNS network traffic destination

Contacts a large (36599) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/45b52f8ff47eb676662dc0b019eb4183a356be94add3f71bc1a86df99ce9ecaf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.