MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c217dbeed8551a9552e1363e8a66c2378181fe0f6b73c4ccc07b7abffd6ba74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments 1

SHA256 hash:	9c217dbeed8551a9552e1363e8a66c2378181fe0f6b73c4ccc07b7abffd6ba74
SHA3-384 hash:	3eb58522cefa335344a79347489dbb8f5313a12a2fae90218f4716355ea27e5afd3875de3b5a890c8e6eeff0b72dc3bd
SHA1 hash:	f6184e98c7e5beab95e699594581d05c620f2aa5
MD5 hash:	f241027e56887d65f6f6c65f5ad8b827
humanhash:	video-artist-pennsylvania-december
File name:	f241027e56887d65f6f6c65f5ad8b827
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	158'432 bytes
First seen:	2024-04-08 00:09:02 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	3072:e3jbQaLQau7I7e50xB4+7LQocU4VWjHwNcLJL:6jdume5aB4+nQoUVcHwNG1
TLSH	T12EF31A85FC909F22C6D3217BFB4E428D371A0768D3EE720399255F21379A9AB0E37146
telfhash	t17ff0a354d7580f0c5ffd88e959dfa126033c740c1f4430833f96574656a31e9320e056
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter	zbetcheckin
Tags:	32 arm elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug php

Link:

https://www.filescan.io/uploads/661335db0b46b303692e8792/reports/e6fcccf8-2189-48d8-885c-8e2a3eb075b5/overview

Result

Verdict:

MALICIOUS

Malware family:

Mirai

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bb40dd27-8e4c-454c-95b6-1796841f024d

Result

Threat name:

Gafgyt, Mirai

Detection:

malicious

Classification:

troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1421871

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/9c217dbeed8551a9552e1363e8a66c2378181fe0f6b73c4ccc07b7abffd6ba74

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c217dbeed8551a9552e1363e8a66c2378181fe0f6b73c4ccc07b7abffd6ba74/

Threat name:

Linux.Trojan.Mirai

Status:

Malicious

First seen:

2024-04-08 00:10:03 UTC

File Type:

ELF32 Little (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tqqx3pxnqvi2svjocnr6rjtmen4bqh7a623tytgma632x76wxj2a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/240408-afgljsaf9t/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9c217dbeed8551a9552e1363e8a66c2378181fe0f6b73c4ccc07b7abffd6ba74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.