MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7
SHA3-384 hash:	36fc42cd0dc5abb32b2e591f46befd06c6db1f927efb12e432d85123931d08215fa297d70ef05143f36be778955d0de7
SHA1 hash:	980013679b8d5e05ab78130ab3e46bdfdc7723f1
MD5 hash:	35710589e5c527a1b54c9ba1150ecffe
humanhash:	steak-south-rugby-eleven
File name:	rh1ele5p8l
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	248'295 bytes
First seen:	2026-04-04 19:14:13 UTC
Last seen:	2026-04-05 13:18:37 UTC
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	6144:0wM1m1qFlHH4APNSTfqEcaDKctbC+MeETu0pU:0wM1mgln4APNQiEcaDL9JMLVpU
TLSH	T1443412839FC251B1E6938A344096D787EB24DD242004DBD5FB1E3EB1A8E23E7F50E659
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

80

Origin country :

DE

Vendor Threat Intelligence

ACCE

Gathering data

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Deleting a recently created file

Sends data to a server

Launching a process

Sets a written file as executable

Changes the time when the file was created, accessed, or modified

Creates or modifies symbolic links

Receives data from a server

Creating a file

Runs as daemon

DNS request

Connection attempt

Changes access rights for a written file

Mounts file systems

Creating a process from a recently created file

Creating a file in the %temp% directory

Writes files to system directory

Substitutes an application name

Creates or modifies files in /cron to set up autorun

Deletes a system binary file

FileScan.io

Gathering data

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

237

Number of processes launched:

7

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7

Behaviour

Anti-VM

Persistence

Process Renaming

Anti-Debugging

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-04-04T16:27:00Z UTC

Last seen:

2026-04-06T13:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dda328b3-be15-4098-b559-ff3c61bd908f

Behavior Graph:

Download SVG

Intezer Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3dd7103f-6ee9-4810-9fa0-849f71f89f9a

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1893494

Signature

Drops files in suspicious directories

Executes the "crontab" command typically for achieving persistence

Sample tries to persist itself using cron

Uses dynamic DNS services

Writes identical ELF files to multiple locations

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-04-04 19:15:50 UTC

File Type:

ELF32 Little (SO)

AV detection:

6 of 38 (15.79%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uinz7w5ogjl6eaxa6svkgk5glur4crzina74djsr5ssc3xvjvhlq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm credential_access discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260404-xxsrgagz2t/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads process memory

Checks SCSI settings

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.23

Link:

https://yomi.yoroi.company/submissions/a21b9fdbae3257e202e0f4aaa32ba65d23c14728683fc1a651eca42ddea9a9d7