MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36
SHA3-384 hash:	2793427fb357c73c73d2f659a8e3b488bae854e73c055fd449a4e2f788856810aeb3d93d2fe52b630a1ed80e150f4171
SHA1 hash:	f8d2e27b373caa4ebf0bc1980f4e3b9c2481faeb
MD5 hash:	8acda12c19831e78dc788337f4d2af42
humanhash:	north-speaker-texas-september
File name:	tmips
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	64'100 bytes
First seen:	2025-08-28 07:33:07 UTC
Last seen:	2025-08-29 06:20:09 UTC
File type:	elf
MIME type:	application/x-executable
ssdeep	768:vURL+aUxrpETBiGunBbJ/mxNuKdqSzav5l4+bUHWG0gPhaOyrEYe4EMLcIM:8r8QxN1HmQ+bUHv6erMY3
TLSH	T19453625E2E319FEDF66CC33547B34A21A26963D523E1D684E2ACD2041F7034D686F7A8
telfhash	t1581117088d3867e5ab361d992badfe76e56130df4a265d378d00fdae8a2d8415e01c1c
Magika	elf
Reporter	abuse_ch
Tags:	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Siggen.9999-9.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Kills processes

Opens a port

Connection attempt

Substitutes an application name

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68b006501c81c34281d6541c/reports/4d0bebbd-fd26-41a6-9944-66c12108421e/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

mips

Packer:

not packed

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

true

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36

Behaviour

Process Renaming

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Verdict:

Unknown

File Type:

elf.32.be

Link:

https://opentip.kaspersky.com/f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a0dcd2b1-05c3-4bc5-815a-47ba3f293e62

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8026dc6c-0aca-458e-a22a-9bccee5d9e99

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1766834

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-08-28 06:41:20 UTC

File Type:

ELF32 Big (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7bding6oajzyfhplprhxg3oulzjwu5l2yuvscjc6nsvgoafhv43a._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/250828-jds18sdj2w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Enumerates running processes

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2dc1db0a-df20-4e31-bbeb-0d8927e1433d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f846869bce0273829deb7c4f736dd45e536a757ac52b21245e6caa6700a7af36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication