MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491
SHA3-384 hash:	d855b5a0ae0a1fb012b4faff943f50136d720fabdf9034bfd4a58f6a33331bb59bb47aac6ae8708c34eb55f449d9e56d
SHA1 hash:	f44bad8fa295c373a7111171d6448fd7950ac3b0
MD5 hash:	4eb398716103b77dd1795afbf7cf7b5c
humanhash:	violet-harry-vegan-don
File name:	185.232.205.129-mips-2025-03-01T22:30:31
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	113'908 bytes
First seen:	2025-03-01 23:27:51 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:LE5h+WX/Y6J9WwyjOumX4reWb091HamIv2GvK5K6fKqXWidemc:gpX/Y6J9WwyWoreWzv2kK5MGfc
TLSH	T192B3E95E2E618FBDF268C33457B74B32979823D227E1D681D2ACD5141F6034E641FBA8
telfhash	t104318d18497813f097b15c9e6aedefb6e5a030df4a261d338e00e9ada66d9824d00c1c
Magika	elf
Reporter	threatquery
Tags:	elf gafgyt

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30455.LC.BadVar.UNOFFICIAL

Unix.Malware.Mirai-9942689-0

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c39907a08f47cf14a3cc6blinux22vpnfull_triage

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Kills processes

Connection attempt

DNS request

Opens a port

Creating a file

Substitutes an application name

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/67c39825f8726576332c170d/reports/60ea7c31-b8a6-4898-8904-9c2bc8c5bddf/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491

Behaviour

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Result

Verdict:

UNKNOWN

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/03bbd15f-b6b8-4109-8754-c434b0c265d4

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1627292

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample reads /proc/mounts (often used for finding a writable filesystem)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491/

Threat name:

Linux.Backdoor.Gafgyt

Status:

Malicious

First seen:

2025-03-01 23:28:37 UTC

File Type:

ELF32 Big (Exe)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v355wnsgj7u3oknemu6qrpn4q2eqr5dbb3tp52dax7fleptyisiq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access discovery

Link:

https://tria.ge/reports/250301-3gatlswp18/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Reads process memory

Enumerates running processes

Renames itself

Unexpected DNS network traffic destination

Verdict:

Malicious

Tags:

Unix.Malware.Mirai-9942689-0

YARA:

n/a

Link:

https://app.threat.zone/submission/7151382a-8d2e-4b15-b37a-2fd243383362

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

BASHLITE

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.