MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb
SHA3-384 hash: 8b8384940044bd0dbe4ac7e8c95d0a8afb1d60516205846a891f47fd2946db94216b54f79e1ff8c268034ffe7a2a40d3
SHA1 hash: 14351f8782906f3b2e391941e24956b0c147b971
MD5 hash: ef2acf002cd3d50ffb7e2035a4ff8f59
humanhash: green-twelve-vegan-music
File name:i686
Download: download sample
Signature Gafgyt
Create hunting rule
File size:205'992 bytes
First seen:2025-08-23 01:21:49 UTC
Last seen:2025-08-23 23:33:27 UTC
File type: elf
MIME type:application/x-executable
ssdeep 3072:9SDXBhJE5p9/UAZ2Hef6WuTaMo+Zqi0HhCkX01:9IBhJE5//UAZHOTaIZxtkE
TLSH T1BD14F6A1E6C7A0F7DD070D31501BF37F96319635986BDEA9EB8C9B94EC239118C08B54
telfhash t17d41e7769ef56bec7bd08802d2db2721ce2de53b350036ad16752bd423b35216276c78
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence

File Origin
# of uploads :
2
# of downloads :
32
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.31075.LX.BOT.UNOFFICIAL
Create hunting rule

Unix.Trojan.Gafgyt-6981160-0
Create hunting rule

Unix.Dropper.Mirai-7135828-0
Create hunting rule

Unix.Dropper.Mirai-7135872-0
Create hunting rule

Unix.Dropper.Mirai-7135893-0
Create hunting rule

Unix.Dropper.Mirai-7135900-0
Create hunting rule

Unix.Dropper.Mirai-7135951-0
Create hunting rule

Unix.Dropper.Mirai-7136105-0
Create hunting rule

Unix.Trojan.Mirai-7759336-0
Create hunting rule

Unix.Trojan.Mirai-7772538-0
Create hunting rule

Unix.Trojan.Mirai-8041689-0
Create hunting rule

Unix.Trojan.Gafgyt-9876285-0
Create hunting rule

Unix.Trojan.Gafgyt-9876369-0
Create hunting rule

Unix.Trojan.Mirai-9885259-0
Create hunting rule

Unix.Trojan.Mirai-9885284-0
Create hunting rule

Unix.Trojan.Mirai-9924065-0
Create hunting rule

Unix.Trojan.Mirai-9933849-0
Create hunting rule

Unix.Trojan.Gafgyt-9940653-0
Create hunting rule

Unix.Trojan.Mirai-9951089-0
Create hunting rule

Unix.Trojan.Mirai-10004218-0
Create hunting rule

Unix.Trojan.Gafgyt-6735924-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sends data to a server
Creating a file
Receives data from a server
Connection attempt
DNS request
Runs as daemon
Substitutes an application name
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated rust
Link:
https://www.filescan.io/uploads/68a917e57137d6845838bffd/reports/cdf0fb61-5311-4ced-9cb0-14da7303d016/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
41
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2025-08-23T00:21:00Z UTC
Last seen:
2025-08-23T00:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/95338081-7b06-402a-ad13-82b313f81f05
Behavior Graph:
Download SVG
%3 guuid=b290da7e-1b00-0000-ceb0-6151640b0000 pid=2916 /usr/bin/sudo guuid=a13cd180-1b00-0000-ceb0-6151660b0000 pid=2918 /tmp/sample.bin write-file guuid=b290da7e-1b00-0000-ceb0-6151640b0000 pid=2916->guuid=a13cd180-1b00-0000-ceb0-6151660b0000 pid=2918 execve guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919 /tmp/libcow.so dns net send-data zombie guuid=a13cd180-1b00-0000-ceb0-6151660b0000 pid=2918->guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 88B 285dd6a5-0fcd-5629-b269-637cf9b4872f 172.233.110.251:8443 guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->285dd6a5-0fcd-5629-b269-637cf9b4872f send: 669B 7f30281f-6565-565b-903e-76ab0b9d4286 stun.l.google.com:19302 guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->7f30281f-6565-565b-903e-76ab0b9d4286 send: 20B b2bd2b2c-e054-5d6d-8cd8-020505ab6beb 172.233.110.251:9000 guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->b2bd2b2c-e054-5d6d-8cd8-020505ab6beb send: 32B guuid=32c4a781-1b00-0000-ceb0-6151680b0000 pid=2920 /tmp/libcow.so net send-data guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->guuid=32c4a781-1b00-0000-ceb0-6151680b0000 pid=2920 clone guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960 /tmp/libcow.so dns net send-data guuid=99208f81-1b00-0000-ceb0-6151670b0000 pid=2919->guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960 clone guuid=32c4a781-1b00-0000-ceb0-6151680b0000 pid=2920->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 225cc634-e8ed-5439-b26c-3620ee7f33a0 91.245.37.161:23 guuid=32c4a781-1b00-0000-ceb0-6151680b0000 pid=2920->225cc634-e8ed-5439-b26c-3620ee7f33a0 send: 163880B guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 502B a4109754-3997-5f42-83f5-f487770de60e dualstack.zd.map.fastly.net:80 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->a4109754-3997-5f42-83f5-f487770de60e send: 115B aa7dc4e4-85df-5e65-857c-5d493d4730fe speed.xiweb.de:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->aa7dc4e4-85df-5e65-857c-5d493d4730fe send: 107B f6310401-d007-5a31-8af3-012a0899ef7b speedtest.dot64.de:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->f6310401-d007-5a31-8af3-012a0899ef7b send: 111B 18b4687a-2192-5e8e-b0af-2dafe593f2f7 speedygonzales.bitel.io:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->18b4687a-2192-5e8e-b0af-2dafe593f2f7 send: 111B efb22362-5fa6-51e4-9271-faf1e07aeb69 speedtest.desloovere-ict.be:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->efb22362-5fa6-51e4-9271-faf1e07aeb69 send: 120B 016a7d7d-2c81-5526-92cc-0be362f4b436 speedtest-ens-nl.as215248.net:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->016a7d7d-2c81-5526-92cc-0be362f4b436 send: 122B 356734c6-dbe0-54ca-9245-7cbb0d3c962c speed.de-west-02.wiit-cloud.io:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->356734c6-dbe0-54ca-9245-7cbb0d3c962c send: 123B 0814c69e-7131-5058-9868-a2aca08d54ba dus.speedtest.contabo.net:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->0814c69e-7131-5058-9868-a2aca08d54ba send: 118B 26b82ba6-267f-5058-aae5-265b91f6c6f6 ookla.lunoxia.net:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->26b82ba6-267f-5058-aae5-265b91f6c6f6 send: 88619609B cf51cdb5-40dc-53bb-900e-1ae963e62f31 speedtest21.hotspot.koeln:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->cf51cdb5-40dc-53bb-900e-1ae963e62f31 send: 118B bd5f037b-7bc6-5a15-b120-b897dce05015 speedtest01.ber.server.camp:8080 guuid=b7d45a96-1b00-0000-ceb0-6151900b0000 pid=2960->bd5f037b-7bc6-5a15-b120-b897dce05015 send: 120B
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d060969c-e6eb-4b86-9867-611f1eb3d13a
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1763325
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb/
Threat name:
Linux.Backdoor.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-08-23 01:22:38 UTC
File Type:
ELF32 Little (Exe)
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6tasdpxi347xt3qhhhmoqn3s5xupz2cuepz6rxmwel5wldv4w5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/250823-brjqqafm31/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Changes its process name
Checks hardware identifiers (DMI)
Enumerates running processes
Reads MAC address of network interface
Reads network interface configuration
Renames itself
Verdict:
Malicious
Tags:
Unix.Trojan.Gafgyt-6981160-0
YARA:
n/a
Link:
https://app.threat.zone/submission/aeb1088f-cbbd-410e-ad92-fae37e814f1f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 47a6090df746f9fbcf7039cec741bb976f47e742a11f9f46ecb117db2c75e5bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3579269/
  
Delivery method
Distributed via web download

Comments