MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4
SHA3-384 hash: 5fdb03dc476103a7849956033268f19fe51c05ae39e6258038d7d2d195cd113665b648ac968289124aac8483dd811435
SHA1 hash: 88c0cc29969e9ed99fb8ff8cbd8160b5039e247e
MD5 hash: 469281f5a3a1190a2403e58500702a71
humanhash: jig-mango-september-winter
File name:469281f5a3a1190a2403e58500702a71
Download: download sample
Signature Gafgyt
Create hunting rule
File size:51'080 bytes
First seen:2021-10-18 21:22:03 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 768:zvt4sleCKO63B2dEx+UliviUjM0qUzew50WMcYOWRR1W1u0JJH:eSZCByYViv7M0qi50WMJw1u0JR
TLSH T18533F12D4394295ECACC6BBEAACC4BD0FA8BD4C6720A5B4D93C750D1913105EB54E47B
Reporter zbetcheckin
Tags:32 elf gafgyt mips

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Unix.Trojan.DarkNexus-7679166-0
Create hunting rule

Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
mips
Packer:
custom
Botnet:
unknown
Number of open files:
7
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
UNKNOWN
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0a8986f7-5c29-4ae5-af30-df558d1ab5c3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/872688
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4/
Threat name:
Linux.Trojan.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 21:22:07 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/211018-z7xvaaehc4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1693406/

Comments


Avatar
zbet commented on 2021-10-18 21:22:04 UTC

url : hxxp://45.95.169.115/StableBins/mipsel