🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d
SHA3-384 hash: e812f94430b34f7ad14c8e365d51cbcdf28829131418dee7306d7092b312eed86c04a46642315ce905d3deb463c89e68
SHA1 hash: 3e635029abc00993a45f7313feb524808be49d4d
MD5 hash: 1444bbbe164b7bb8292c3a168219aec5
humanhash: aspen-beer-charlie-victor
File name:bot.armv6l
Download: download sample
Signature Gafgyt
Create hunting rule
File size:80'436 bytes
First seen:2026-05-13 20:55:35 UTC
Last seen:2026-05-13 23:25:22 UTC
File type: elf
MIME type:application/x-executable
ssdeep 1536:GwQhrNjQGv5g/VtQfSv+vkIpWqW7LuxvFi1wWOS/Z2Qxqb7:GJ5gNKVMi/8utFuw0Rqb7
TLSH T133730991FE81D952C5D939BAFA5F41C8338303ACD3DF72028E019A35A6DF51A4E7AE41
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DDoS.2637.20665.9366.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Manages services
Runs as daemon
Sets a written file as executable
Launching a process
Creating a file
Connection attempt
Opens a port
Substitutes an application name
Creates or modifies symbolic links in /init.d to set up autorun
Creates or modifies files in /init.d to set up autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
rust
Link:
https://www.filescan.io/uploads/6a04e5732fcb905ec2956a11/reports/bff3f344-78de-4b98-96f0-f398a95d732b/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2026-05-13T17:30:00Z UTC
Last seen:
2026-05-14T21:54:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a0cfd0b1-a377-4c9d-9485-7f55988266af
Behavior Graph:
Download SVG
%3 guuid=8b899346-1900-0000-656e-58f2a50a0000 pid=2725 /usr/bin/sudo guuid=25f65949-1900-0000-656e-58f2a80a0000 pid=2728 /tmp/sample.bin guuid=8b899346-1900-0000-656e-58f2a50a0000 pid=2725->guuid=25f65949-1900-0000-656e-58f2a80a0000 pid=2728 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5d846bb0-70e6-442e-8e4c-2328f2c27bfe
Result
Threat name:
Mirai, Gafgyt
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1913184
Signature
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Detected Mirai
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Found malware configuration
Malicious sample detected (through community Yara rule)
Sample deletes itself
Sample tries to kill a massive number of system processes
Sample tries to kill multiple processes (SIGKILL)
Sample tries to persist itself using cron
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Yara detected Gafgyt
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1913184 Sample: bot.armv6l.elf Startdate: 13/05/2026 Architecture: LINUX Score: 100 157 faggotcnc.duckdns.org 2->157 159 24.171.217.23, 10001, 23, 2323 LCPRLUS United States 2->159 161 9 other IPs or domains 2->161 175 Suricata IDS alerts for network traffic 2->175 177 Found malware configuration 2->177 179 Malicious sample detected (through community Yara rule) 2->179 183 4 other signatures 2->183 15 bot.armv6l.elf 2->15         started        17 systemd sh 2->17         started        19 systemd sh 2->19         started        21 26 other processes 2->21 signatures3 181 Uses dynamic DNS services 157->181 process4 process5 23 bot.armv6l.elf 15->23         started        25 bot.armv6l.elf 15->25         started        27 sh wget 17->27         started        30 sh sh 17->30         started        32 sh curl 17->32         started        34 sh chmod 17->34         started        36 sh chmod 19->36         started        38 sh sh 19->38         started        40 2 other processes 19->40 file6 42 bot.armv6l.elf 23->42         started        151 /tmp/load.sh.5, POSIX 27->151 dropped 45 sh wget 30->45         started        process7 signatures8 185 Sample tries to kill a massive number of system processes 42->185 187 Sample tries to kill multiple processes (SIGKILL) 42->187 189 Sample tries to set files in /etc globally writable 42->189 191 3 other signatures 42->191 47 bot.armv6l.elf sh 42->47         started        49 bot.armv6l.elf sh 42->49         started        51 bot.armv6l.elf sh 42->51         started        53 5 other processes 42->53 process9 process10 55 sh system048 47->55         started        57 sh crontab 49->57         started        61 sh 49->61         started        63 sh crontab 51->63         started        65 sh 51->65         started        67 sh update-rc.d 53->67         started        69 sh systemctl 53->69         started        71 sh systemctl 53->71         started        73 sh systemctl 53->73         started        file11 75 system048 sh 55->75         started        77 system048 wget 55->77         started        92 2 other processes 55->92 139 /var/spool/cron/crontabs/tmp.DxklGW, ASCII 57->139 dropped 193 Sample tries to persist itself using cron 57->193 195 Executes the "crontab" command typically for achieving persistence 57->195 79 sh crontab 61->79         started        82 sh grep 61->82         started        141 /var/spool/cron/crontabs/tmp.I4Y0Cl, ASCII 63->141 dropped 84 sh crontab 65->84         started        86 sh grep 65->86         started        197 Sample tries to persist itself using System V runlevels 67->197 88 update-rc.d systemctl 67->88         started        90 systemctl systemd-sysv-install 69->90         started        signatures12 process13 signatures14 94 sh bot.powerpc 75->94         started        96 sh bot.mips 75->96         started        98 sh bot.mipsr 75->98         started        106 39 other processes 75->106 199 Executes the "crontab" command typically for achieving persistence 79->199 100 systemd-sysv-install update-rc.d 90->100         started        102 systemd-sysv-install update-rc.d 90->102         started        104 systemd-sysv-install getopt 90->104         started        process15 file16 109 bot.powerpc 94->109         started        111 bot.powerpc 94->111         started        113 bot.mips 96->113         started        115 bot.mips 96->115         started        117 bot.mipsr 98->117         started        119 bot.mipsr 98->119         started        121 update-rc.d systemctl 100->121         started        123 update-rc.d systemctl 102->123         started        143 /tmp/bot.x86_64, ELF 106->143 dropped 145 /tmp/bot.sh4, ELF 106->145 dropped 147 /tmp/bot.powerpc, ELF 106->147 dropped 149 11 other malicious files 106->149 dropped 125 2 other processes 106->125 process17 process18 127 bot.powerpc 109->127         started        131 bot.mips 113->131         started        133 bot.mipsr 117->133         started        135 bot.m68k 125->135         started        file19 153 /etc/rc.local, ASCII 127->153 dropped 155 /etc/init.d/system048, POSIX 127->155 dropped 163 Sample tries to kill a massive number of system processes 127->163 165 Sample tries to kill multiple processes (SIGKILL) 127->165 167 Sample tries to set files in /etc globally writable 127->167 169 Drops files in suspicious directories 131->169 171 Sample deletes itself 131->171 173 Sample tries to persist itself using System V runlevels 131->173 137 bot.m68k sh 135->137         started        signatures20 process21
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-13 20:14:36 UTC
File Type:
ELF32 Little (Exe)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lp4o7k6iy4s4cepr5mfojvjkbgwvdouxnngimvnmz7i76gu6heoq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm credential_access defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260513-zq7cdsav4l/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads process memory
Creates/modifies Cron job
Enumerates running processes
Modifies init.d
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Unexpected DNS network traffic destination
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ELF_IoT_Persistence_Hunt
Create hunting rule
Author:4r4
Description:Hunts for ELF files with persistence and download capabilities
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3846358/
  
Delivery method
Distributed via web download

Comments