MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c39ad4c5337162fd8c8e953a26cbed9889b34c6f651fa32078018984c77849f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	c39ad4c5337162fd8c8e953a26cbed9889b34c6f651fa32078018984c77849f9
SHA3-384 hash:	a2eb5370567af9359a070cd8b5c030183220513367039ce5749b6199708dd442078b336c654105f09e4cf7f9a4e15e25
SHA1 hash:	08334f33109dba61d686422a115dff883a4709c2
MD5 hash:	ff93b127fb23e66b9fbf9062061590b3
humanhash:	muppet-double-timing-lithium
File name:	ff93b127fb23e66b9fbf9062061590b3
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	38'040 bytes
First seen:	2021-11-29 09:20:13 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	768:s8TlsNMBdyTtX2dtFbzOc/R2D4JS69nnACJgGlzDpxYsF:TTlsGyTcxa4P9AGVrYW
TLSH	T1B403F16D170620DED028D43B71A8AB50BD604BBFC5C3ED175270B2E98622469BC36FC5
Reporter	zbetcheckin
Tags:	32 elf gafgyt mips

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Unix.Trojan.DarkNexus-7679166-0

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/61a49b81bbfd2af97cb9924f/reports/d479090e-f6eb-4690-a350-0020e3ff34a7/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/c39ad4c5337162fd8c8e953a26cbed9889b34c6f651fa32078018984c77849f9

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

54.37.79.0:666

UDP botnet C2(s):

not identified

Result

Verdict:

MALICIOUS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3bfacdea-083d-4914-a9b6-ecc4741db3e5

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/897794

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c39ad4c5337162fd8c8e953a26cbed9889b34c6f651fa32078018984c77849f9/

Threat name:

Linux.Trojan.Gafgyt

Status:

Malicious

First seen:

2021-11-28 02:20:12 UTC

File Type:

ELF32 Big (Exe)

AV detection:

13 of 45 (28.89%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

10/10

Tags:

linux suricata

Link:

https://tria.ge/reports/211129-lbbqaabhel/

Behaviour

Reads runtime system information

Reads system network configuration

Reads system routing table

suricata: ET MALWARE ELF/BASHLITE CnC Activity (Response)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c39ad4c5337162fd8c8e953a26cbed9889b34c6f651fa32078018984c77849f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.