MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74
SHA3-384 hash:	c31365a6daa0b54a3efdb3a43dce12187bbe553cc7c24ae1cc8788e68f7d6e15eb91eb60fa1c2b4d6aae1536242fac44
SHA1 hash:	44ec6e9e6c6c4aed22ddf0de2fd4d5536ffb1c7f
MD5 hash:	ebaf6768ac8705e48d2403468bf8df74
humanhash:	bacon-two-hot-july
File name:	mips
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	61'468 bytes
First seen:	2024-12-11 06:36:38 UTC
Last seen:	2025-02-22 23:30:05 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:1kOxDgAsz7DmrmaI/RZr0nZCwC0dkl4OGFlBv:XIDmrmaI/RZronC0dkl4bFTv
TLSH	T18053744A2A314FAEF73C823A87B75E34975822D11AE1D648D27CF9021F7070D685FB99
telfhash	t1be016908153c17f1d3808cdeabddff34a49184db99661f37cd40e5aaa722a838c00d2c
Magika	elf
Reporter	lontze7
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Mirai.4514.14795.32710.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/675933141e9e946507faab60/reports/594443c3-9803-446c-9094-e78554103ace/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/cdd6a147-6cd9-494a-aef5-c95e12a38c6b

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1572898

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2024-12-11 06:37:07 UTC

File Type:

ELF32 Big (Exe)

AV detection:

6 of 38 (15.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j7dtwav5btcnitxi3ib44wvyw5h3m5aj7mrdypzwwbw4eloa3v2a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/241211-hdgsja1mhy/

Behaviour

System Network Configuration Discovery

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b5e63c79-4d3c-48ff-86da-fcf9513e7afb

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 9b824561f92c7fb6c38c107f50901c7cdeb2021be37f77a4383b8d6e5b3ad675

Gafgyt

elf 4fc73b02bd0cc4d44ee8da03ce5ab8b74fb67409fb223c3f36b06dc22dc0dd74

(this sample)

Delivery method

Distributed via web download

Dropped by

SHA256 9b824561f92c7fb6c38c107f50901c7cdeb2021be37f77a4383b8d6e5b3ad675

Dropped by

MD5 4f8408ef6a7f58506d6997361fa4bd5e

Dropped by

SHA256 595aef3562d7599de9ff889b7793282596f8d7c4c3d5632e9c9021561b438962

Dropped by

MD5 601fbdd309c0a288ec990607d4cb769f

Dropped by

SHA256 f3f014794a53d1c884951eda59c8436158b6ef0944952a5a00b9214597d1d26d

Dropped by

MD5 4acd5252dc8d0df9359f8ad7ef422a1d

Dropped by

SHA256 05e5fb6c5eda8ad555044f7caa66e17348a8f0aef00cc9031113c902c22d5df5

Dropped by

MD5 3de4598eb8f4b085566f753d276842d7

Dropped by

SHA256 19df9599c35847d7ebd4aeccbce3f26a4fee6a782b62eb48e62177c4c373922d

Dropped by

MD5 6f38ea958266bde0b81a1869ea10adf1

Dropped by

SHA256 e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796

Dropped by

MD5 72ec6236779400f333407933ee5759e9

Dropped by

SHA256 fdf1e731ef1ab95b8e50a3b0c2456902b77e19f5b1c55fe485bac3c3f97f690c

Dropped by

MD5 c13727fd8d1de6bf7605f59abca391e5

Dropped by

SHA256 56a83d7957560a6c8a77c87fff1219627f5d87f2be8009b5611bedfd88779b64

Dropped by

MD5 994c1d924650909c7bec0da40fe9f222

Dropped by

SHA256 a02b076dd32c91403c500e9c8e8ee3fd36e29725f4bd3336e9d31b38a51a85b6

Dropped by

MD5 5957e5d91936d38be2a9528ee1dd6e56

Dropped by

SHA256 a12e8eef819382c30aacec4f6b1949cbf6e170514ef74e35844cc7dedac76215

Dropped by

MD5 d48594089ad5b80ebd03798aafbe5f1c

Dropped by

SHA256 b8c0f320b63872f9b6ff16555a6d750c4ddb3a0b588991f9ba41f0c3bf85debb

Dropped by

MD5 8b7c392f7f1f5153fc0e4eb346deb851

Dropped by

SHA256 37b1b6fbc91a541e40849709847de715a9cdbc32899cb7f2e60d19fe9b1b9b0f

Dropped by

MD5 b4d7f2d75406080a6be17678a01d66ee

Dropped by

SHA256 b4d8d8b7f5def6ed65a9e7c89755969831a820ca79b93f1da3fd81ddb6b527d9

Dropped by

MD5 3344a6ca829686d7e0e3a7802dd0217b

Dropped by

SHA256 5d5ee4bf2e2bba27e6af5a5f45846a7175c61f094e6e61a920f042f40889e387

Dropped by

MD5 2e3f525550b853a6deabdc7f0b8cc6b3

Dropped by

SHA256 38e9094913667faf627b9029b35126b32af62e737815887b06ca41e361f3321d

Dropped by

MD5 296a7180684503f0ea42952c04fd33ab

Dropped by

SHA256 c57b1e4cd5f09ab3405472cbb68ebcffe888ba8bb7c49e3cf8c6884cac72b9d8

Dropped by

MD5 ce832c313befa7780f6c43c984de0c58

Dropped by

SHA256 23bfbfe290b67f9cb00cfb63dd0028bd9c5a31286cfda950ef36c66154a5e443

Dropped by

MD5 59b41ef0b7820b1ffb237b296e5c0b33

Dropped by

SHA256 90daf9a0bb6a581afc4a0850680922e658d7d19cd017ffabf3c0c32302bfe7fc

Dropped by

MD5 0faf76e233826f328c894f87a73f4202

Dropped by

SHA256 aef14733416654805ec12cf12def5b09e5ddb1938e1f95b3b037cfeec3f1ece9

Dropped by

MD5 0f7650dd3a5623947d7bf92f95cb333b

Dropped by

SHA256 be0eb318023124edbbf9be144a292f2e0ef409a0bd4aa2df0f21352330ce8be2

Dropped by

MD5 8d21f1c960db87329aff091b8bbd5548

Dropped by

SHA256 4c40c913e09b1db0c275000124786d45c50ca0942abe927b08e1063e519a2d5b

Dropped by

MD5 4460244e990e896b83394a4b819f474c

Dropped by

SHA256 45b2368510c8b71d2a4ba279c437ed6506f0c52c6eee5d07a8c999dcaa28972a

Dropped by

MD5 ea1e6e7a2307500894d23634c9cb6d2b

Dropped by

SHA256 9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14

Dropped by

MD5 804058fac9138c413b9e1c5ab646206d

Dropped by

SHA256 e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae

Dropped by

MD5 e7bedca7578054f7d6b63125bf8e82b4

Dropped by

SHA256 7f455160c2db6e8cfb31dfb91a8ed34c4641d293ee4cd53fd6f0dc2dd087abfe

Dropped by

MD5 518c4ee3fdcfba8d84e249cd29e7b601

Dropped by

SHA256 4687de1512502430b784010f1d41bba2649b2de3f4544373448d203d2a2e1880

Dropped by

MD5 b889701096b2ae74fbbe02709820a7d1

Dropped by

SHA256 5b6af3be2be4ea4848f96e7638ce11fee29e2dafeadf0a7f720882f3100864f8

Dropped by

MD5 4abdb3a4f2fffb34a99805a997543ebe

Dropped by

SHA256 9ec7552a4e45f5831e5e5cdb5f03f8cd96a88e725e7a09ba72fe1d00f63bccfe

Dropped by

MD5 45fb5ea21cc638ba1b4a82fc868c38f8

Dropped by

SHA256 9b2c9bb39f43c04de7f8b55d029b412418a23d6991936be1098370d574b726ab

Dropped by

MD5 1fdb019eef37223a8849f6016b6bdf7d

Dropped by

SHA256 8a267a02638559581d8ad64227f5f653a3cd8963e7e70cbdedb296476788d630

Dropped by

MD5 b2bc8b3c0e2a95d7d8b566b0687ca287

Dropped by

SHA256 15ddd9bc0827b5c6eb17fc6a6a6176e73c83b976db2dd3b915206d5f737de766

Dropped by

MD5 7c50a495155c60846ffdfd90395c6912

Dropped by

SHA256 d627bbd599a5f010bbe631f3298e40aa8a60adf94b765e90341404a8c7487155

Dropped by

MD5 22a56f234379f83c5dda24883c3e0738

Dropped by

SHA256 d950b5354a32c76f5e35f3c1e8255b0a08db2f191656f2588c9436adf84506b4

Dropped by

MD5 9cb9d27fc1ed1236ea8109cfd2880d39

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample