MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 9

Intelligence 9 IOCs YARA 14 File information Comments

SHA256 hash:	5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863
SHA3-384 hash:	4af4ff74be265d749791f14ac91537a8fb4d392b3664c34b220da590266dc28cd25b757e87759dc282907da10e093fb2
SHA1 hash:	df7cf8b164f86f282c747bacec847df42937da3a
MD5 hash:	0fc19cbfa36e288480f16a1abb577d06
humanhash:	nebraska-nitrogen-cardinal-two
File name:	assailant.arm6
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	142'847 bytes
First seen:	2026-06-20 12:52:52 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:4pfNtKdcp3eQwP+HxP9xaefXW8QupNuXPFuw45hLlFOo6E6ErmyhQCYMhEFg:MHxP9xaefXW8Q3ur5hLlFOomyhQCYMhd
TLSH	T16BD33B05D8509727C6E227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021
telfhash	t1a831d05399f587186fb75d34acbc07f11151aa227250bf70af4ec1808937002b479d9b
Magika	elf
Reporter	BlinkzSec
Tags:	gafgyt

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

Gains root access

Connection attempt

Substitutes an application name

Verdict:

Malicious

File Type:

ELF 32 LE

Detections:

HEUR:Backdoor.Linux.Gafgyt.fh HEUR:Backdoor.Linux.Gafgyt.f HEUR:Backdoor.Linux.Gafgyt.bl HEUR:Backdoor.Linux.Gafgyt.bj HEUR:Backdoor.Linux.Gafgyt.a

Link:

https://opentip.kaspersky.com/5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2055d52a-bb61-4f9c-9621-1fac35517610

Behavior Graph:

Download SVG

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/efd8fef7-4187-4682-bd6a-cddaca89b965

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863

Threat name:

Linux.Trojan.Gafgyt

Status:

Malicious

First seen:

2026-06-20 12:49:31 UTC

File Type:

ELF32 Little (Exe)

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k443knarfuzhm2ortidpuhvg7otl6viq6kb57uvmkypu5x3ltbrq._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt botnet

Link:

https://tria.ge/reports/260620-p413ese12k/

Behaviour

Changes its process name

Writes DNS configuration

Malware Config

C2 Extraction:

203.159.90.249:42516

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	ELF_Toriilike_persist Create hunting rule
Author:	4r4
Description:	Detects Torii IoT Botnet (stealthier Mirai alternative)
Reference:	Identified via researched data

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	linux_generic_ipv6_catcher Create hunting rule
Author:	@_lubiedo
Description:	ELF samples using IPv6 addresses

Rule name:	Linux_Generic_Threat_d2dca9e7 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Gafgyt_30444846 Create hunting rule
Author:	Elastic Security

Rule name:	Linux_Trojan_Gafgyt_6a510422 Create hunting rule
Author:	Elastic Security
Reference:	14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628

Rule name:	Linux_Trojan_Gafgyt_6ae4b580 Create hunting rule
Author:	Elastic Security
Reference:	14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628

Rule name:	Linux_Trojan_Gafgyt_d2953f92 Create hunting rule
Author:	Elastic Security
Reference:	14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628

Rule name:	Mal_LNX_Gafgyt_Botnet_ELF Create hunting rule
Author:	Phatcharadol Thangplub
Description:	Use to detect Gafgyt botnet, and there variants.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3868141/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample