MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb
SHA3-384 hash:	3d65a01be50ae2be91e7c3b163c8cc663e6dd9c19f4025025098fd0856ef4a09dfee98d73f6ce8a2d3728dfabc64a3eb
SHA1 hash:	4c6fc4009ff0621e2d525240074435479fc75402
MD5 hash:	7c90facda9f66d1a3f2d72a16c363e09
humanhash:	three-sodium-berlin-twenty
File name:	fkrh9nd7jk
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	250'562 bytes
First seen:	2026-05-05 05:51:40 UTC
Last seen:	2026-05-05 07:47:33 UTC
File type:	elf
MIME type:	application/x-sharedlib
ssdeep	6144:1N5jXOOlU6xE2mmAPBl9MTE7Wbts6EfjRTDoU:1N5jXOOlDlJAPuT0j6EfjtJ
TLSH	T1FE3412C1CED781A1C20F953211AB778FAAB5CD7A8504CB66E7887521DE97EF3220F251
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

74

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creates or modifies symbolic links

Connection attempt

Changes access rights for a written file

Mounts file systems

Changes the time when the file was created, accessed, or modified

Sets a written file as executable

Runs as daemon

Creating a file in the %temp% directory

Creating a file

Deleting a recently created file

Creating a process from a recently created file

Launching a process

Creates or modifies files in /cron to set up autorun

Writes files to system directory

Substitutes an application name

Deletes a system binary file

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

rust

Link:

https://www.filescan.io/uploads/69f9859adf14f1cb2aca446f/reports/e7e4210a-a60e-4db0-a9a2-233aab5ccb24/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

true

Architecture:

x86

Packer:

UPX

Botnet:

unknown

Number of open files:

241

Number of processes launched:

7

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb

Behaviour

Anti-VM

Persistence

Process Renaming

Information Gathering

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-05-04T22:29:00Z UTC

Last seen:

2026-05-05T04:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/356923a6-f2a1-4d3d-a0ad-a52b0fc6ca34

Behavior Graph:

Download SVG

Intezer Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/52a5334f-4ad0-43bc-b130-10805967ed6f

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1908475

Signature

Antivirus detection for dropped file

Drops files in suspicious directories

Executes the "crontab" command typically for achieving persistence

Multi AV Scanner detection for submitted file

Sample tries to persist itself using cron

Writes identical ELF files to multiple locations

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb/

ReversingLabs TitaniumCloud Linux.Trojan.Multiverze

Threat name:

Linux.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-05 01:47:52 UTC

File Type:

ELF32 Little (SO)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z6w5xsmepnxd54xx7qkl6ym5mpqavv7tgiwzavokb3sdvvbk3tnq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm credential_access discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260505-gkxxnagx81/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads process memory

Checks SCSI settings

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cfaddbc9847b6e3ef2f7fc14bf619d63e00ad7f3322d9055ca0ee43ad42adcdb