MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a
SHA3-384 hash:	3d01de971e3c44821f3aa1a62dd00a71d71b0669bcc0882244feb1b25bf8919a5743834b250b229f2075a2a4002fe6fa
SHA1 hash:	3018dcad8f81bb28725eaa48bcbaf8e43f57e97d
MD5 hash:	6f7fc1b03575e8d721a9a60c95119701
humanhash:	single-yellow-lamp-eleven
File name:	arm7
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	33'992 bytes
First seen:	2024-12-13 06:31:13 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:gbyn6/5iVYRdyRcp5cQToEdoQcykv/GGb/iYRphWVpWXe:g+nXVYRd1zcQ0X5ykv/G8/iYndX
TLSH	T15AE23B4AFD819F01D4D0227EFE6E524E33331B58E3EA7201AE119B246B8ED5E0F76855
telfhash	t15ed02b60c8954ce87ed4804b710d72a36e31a0df3d9a3d8873f6eccd0870abc9511a8c
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Unix.Trojan.Mirai-7732430-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675bd602259e5b60544e1ce3linux22vpnfull_triage

Tags:

malware

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Connection attempt

Creating a file

Receives data from a server

Opens a port

Sends data to a server

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/675bd4eedcb1ffa21ae8890a/reports/a9076b47-8b7a-492d-ad1d-b044c40bc8be/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

arm

Packer:

not packed

Botnet:

unknown

Number of open files:

1

Number of processes launched:

1

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Intezer LeetHozer

Malware family:

LeetHozer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/515af3fb-f5bd-421b-946e-f6bc8edbc165

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1574244

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-13 02:40:32 UTC

File Type:

ELF32 Little (Exe)

AV detection:

15 of 23 (65.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=px7ztp6xpzdyyrvnglxzbax2ennfjdl2xyotigdpc6fzker2leva._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/241213-hal8vaspdn/

Behaviour

Writes file to tmp directory

Modifies Watchdog functionality

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Unix.Trojan.Mirai-7732430-0

YARA:

n/a

Link:

https://app.threat.zone/submission/0db2fefa-dbc6-40c1-86dd-f9ef66400022

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7dff99bfd77e478c46ad32ef9082fa235a548d7abe1d34186f178b95123a592a