MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006
SHA3-384 hash: 56f29153b6365954e8e08ac595dccb6e93f993550bea03c5cfbe059e6c077cb011e2323c8d930fd0abd2abb46f8adaf8
SHA1 hash: 345c9cc9b4713204c01c4f0efa87e83b56e6104c
MD5 hash: 0eb9fa945b9ec2e37adf13f80fd05e42
humanhash: mike-cardinal-whiskey-social
File name:powerpc
Download: download sample
Signature Gafgyt
Create hunting rule
File size:55'832 bytes
First seen:2026-08-12 02:04:56 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 1536:kCoQp04I0Naku1dFb1qhSE1qqUH4UZHgeMvLFL7UAVQbyUmn4u+qgw09O:dqQIH1dqhSEcqU/gJpLwAVQbu4u+qgwr
TLSH T1D843F194F0488DB4F64B48B46CEBC5C067F1DF9577428EB249C08FA25161DA23BEA19F
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf UPX
File size (compressed) :55'832 bytes
File size (de-compressed) :150'336 bytes
Format:linux/ppc32
Unpacked file: 75761cb6afe1c0f94bf99b0d0647fcc843f205904892f71c912f7d3290ed29ad

Intelligence

File Origin
# of uploads :
1
# of downloads :
31
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/91efd690-e1b5-4614-9e42-d853059b7f71/
Detection(s):
Unix.Trojan.Mirai-10028970-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Opens a port
Receives data from a server
Sends data to a server
Connection attempt
Runs as daemon
Substitutes an application name
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/efa81247-c590-48d1-a35d-d8c0623914ff
Behavior Graph:
Download SVG
%3 guuid=460ef537-1800-0000-84c1-a6918a0c0000 pid=3210 /usr/bin/sudo guuid=f408173a-1800-0000-84c1-a691900c0000 pid=3216 /tmp/sample.bin guuid=460ef537-1800-0000-84c1-a6918a0c0000 pid=3210->guuid=f408173a-1800-0000-84c1-a691900c0000 pid=3216 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0475e912-f0d2-47e4-906c-bc31bb326ac8
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1956488
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6sndmjexejj4celomhoeyxyu3lk7m7ogvp3mcylgnxar7qkmada._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
linux upx
Link:
https://tria.ge/reports/260812-ch8txswhmf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006

(this sample)

Gafgyt

elf 75761cb6afe1c0f94bf99b0d0647fcc843f205904892f71c912f7d3290ed29ad

  
URLhaus
https://urlhaus.abuse.ch/url/3893947/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 75761cb6afe1c0f94bf99b0d0647fcc843f205904892f71c912f7d3290ed29ad
  
Dropping
MD5 ade92ace8354b4e3c4fadb9d4eafb28b

Comments