MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d06d1cad5c3492ec5a79681906114e8a59a8bde37b85f5906f0f1d182800441. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Gafgyt


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments

SHA256 hash: 8d06d1cad5c3492ec5a79681906114e8a59a8bde37b85f5906f0f1d182800441
SHA3-384 hash: 5f159dd0443cadcdd9dba8060b80d2ac320775d1e57e218c4e7f7f7b5162b34f1239e940f2690adf5e90d0ba32fe7b38
SHA1 hash: 17877598fb6e54ac080fc9e3f58021d724a0a28a
MD5 hash: 03e886b39d22acb4582433d6f81a3fb6
humanhash: triple-leopard-twenty-monkey
File name:8cb7qpuydx
Download: download sample
Signature Gafgyt
File size:28'757 bytes
First seen:2026-03-03 07:41:50 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 384:t2S0dcs/Olzp7kDUSv/y9nOPURiuJknhVuHzWlxWlpaQzhWrBxD0KnqEgLAZAPR6:RkSVOPUJaazWlxWbajBWKycZAPazErYJ
TLSH T149D24A86EDD2D1F1E0838572009BAB9BDB35DF260004CA97E3487F64ACA1797515F6AC
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence


File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai rust
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
2
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Status:
terminated
Behavior Graph:
%3 guuid=bf0a92c8-1500-0000-8442-a922270c0000 pid=3111 /usr/bin/sudo guuid=660850cb-1500-0000-8442-a9222f0c0000 pid=3119 /tmp/sample.bin guuid=bf0a92c8-1500-0000-8442-a922270c0000 pid=3111->guuid=660850cb-1500-0000-8442-a9222f0c0000 pid=3119 execve
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Linux.Trojan.Multiverze
Status:
Malicious
First seen:
2026-03-03 07:42:16 UTC
File Type:
ELF32 Little (SO)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf 8d06d1cad5c3492ec5a79681906114e8a59a8bde37b85f5906f0f1d182800441

(this sample)

  
Delivery method
Distributed via web download

Comments