MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0
SHA3-384 hash: b4180af081fee0c8dd92fe43f09d56f5bc58d069e6d2ef8c13c54eb701cb4893fa7f56af698a6cbc647ad4c829c0a0f5
SHA1 hash: 8d96b531b9214727bb08533d1362a1f3f3d9ffd0
MD5 hash: 3629f097bf93bbb5149c85e18de6929a
humanhash: steak-east-bakerloo-juliet
File name:m68k
Download: download sample
Signature Gafgyt
Create hunting rule
File size:58'885 bytes
First seen:2025-10-29 05:20:47 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:abM70ogb5AWLYgam8h7/kbXyQ0zoBoThscMomyOTAHoIn8V78RbayU6:aUw5AhY89KXyQooBoTicMomyOcIMQQS6
TLSH T143431892B801EFB7F40EE77644D34725B270FA664A63163173177D6AAA362C43827F05
telfhash t11601c0a551b3851c1e7298344cfc46f92d16b62327817f70af0ac4949937001f23bf4b
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.Mirai-6981989-0
Create hunting rule

Unix.Dropper.Mirai-7139229-0
Create hunting rule

Unix.Trojan.Gafgyt-7782058-0
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
gcc
Link:
https://www.filescan.io/uploads/6901a45ff1fa8cbc03111978/reports/4218285e-c02b-492b-bf8b-edda876ca91b/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2025-10-29T03:31:00Z UTC
Last seen:
2025-10-29T04:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3a28b211-2c4d-496e-a254-e69c0ae495c7
Behavior Graph:
Download SVG
%3 guuid=d97ce80d-1b00-0000-ea25-12f5c40a0000 pid=2756 /usr/bin/sudo guuid=65ea6010-1b00-0000-ea25-12f5c70a0000 pid=2759 /tmp/sample.bin guuid=d97ce80d-1b00-0000-ea25-12f5c40a0000 pid=2756->guuid=65ea6010-1b00-0000-ea25-12f5c70a0000 pid=2759 execve
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7e436e11-f839-4e8f-8200-00532907e2ef
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1803648
Signature
Antivirus / Scanner detection for submitted sample
Contains symbols with names commonly found in malware
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1803648 Sample: m68k.elf Startdate: 29/10/2025 Architecture: LINUX Score: 76 27 193.111.78.190, 41640, 41642, 41644 AS209737TR Finland 2->27 29 169.254.169.254, 80 USDOSUS Reserved 2->29 31 3 other IPs or domains 2->31 33 Suricata IDS alerts for network traffic 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Antivirus / Scanner detection for submitted sample 2->37 39 2 other signatures 2->39 9 m68k.elf 2->9         started        11 python3.8 dpkg 2->11         started        signatures3 process4 process5 13 m68k.elf 9->13         started        15 m68k.elf 9->15         started        process6 17 m68k.elf sh 13->17         started        process7 19 sh sh 17->19         started        21 sh wget 17->21         started        23 sh chmod 17->23         started        25 sh rm 17->25         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0/
Threat name:
Linux.Backdoor.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-10-29 02:23:06 UTC
File Type:
ELF32 Big (Exe)
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pwxcjsjreoahqbrmwbf7dzo2e4tluctu6z4f6iuycdziravpaoya._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/251029-f2bkbaek7z/
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Trojan.Mirai-6981989-0
YARA:
Linux_Trojan_Gafgyt_751acb94
Link:
https://app.threat.zone/submission/58bc1c07-0de0-4cae-acda-4172cd8ccf74
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Trojan_Gafgyt_751acb94
Create hunting rule
Author:Elastic Security
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3688720/
  
Delivery method
Distributed via web download

Comments