MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4
SHA3-384 hash: bd29f42b4bb0eaffbb6e2e4b3e2415fb1cb2c5b4eb36a1f036c0e41b45a556959970d3ac3ad0579999c98e4e667f18fb
SHA1 hash: f14cb77d2f44cef48cbb7bf066c2eca7a5a48221
MD5 hash: 2e235d1be19250c807611d0949b3ca0c
humanhash: eighteen-oscar-jig-april
File name:ionetworks.mpsl
Download: download sample
Signature Gafgyt
Create hunting rule
File size:167'221 bytes
First seen:2025-12-13 02:35:10 UTC
Last seen:Never
File type: elf
MIME type:application/x-executable
ssdeep 3072:3VfM4PcmEtxT4iFB7g4OX1aJGTx1TJ4i5k5uZ2qpO3Q21uaDFjCTr8xd+kQokebe:3VfM4PcmEtxT4iFB7g4OX1aJGTx1TJ4s
TLSH T199F3A71777608EB7D81ECE3306995700208DD59922A8BB7B73B4C61CFB9A54E0BE7D84
telfhash t1e4215203a1b98a192fb79d64ac7c06f11261a623b3417eb0ef1ec1c48d37002b83dc9b
Magika elf
Reporter abuse_ch
Tags:elf gafgyt

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.29325.LC.Pl.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Mirai-81.UNOFFICIAL
Create hunting rule

Unix.Dropper.Mirai-7139229-0
Create hunting rule

Unix.Trojan.Mirai-9864781-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
gcc masquerade mirai
Link:
https://www.filescan.io/uploads/693cd0f4cf690d27f3de611c/reports/7ac7fe85-aca6-4900-9026-388f5e697ca6/overview
Verdict:
Malicious
File Type:
elf.32.le
First seen:
2025-12-12T08:49:00Z UTC
Last seen:
2025-12-14T23:48:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Linux.Mirai.h HEUR:Backdoor.Linux.Gafgyt.bj HEUR:Backdoor.Linux.Gafgyt.az
Link:
https://opentip.kaspersky.com/fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/104d5bb0-2fde-4fc5-ad07-65fc538ed317
Result
Threat name:
Mirai, Gafgyt, Xmrig
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1831949
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Mirai
Detected Stratum mining protocol
Found malware configuration
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Opens /proc/net/* files useful for finding connected devices and routers
Sample deletes itself
Sample reads /proc/mounts (often used for finding a writable filesystem)
Stdout / stderr contain strings indicative of a mining client
Suricata IDS alerts for network traffic
Tries to load the MSR kernel module used for reading/writing to CPUs model specific register
Uses known network protocols on non-standard ports
Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher)
Yara detected Gafgyt
Yara detected Mirai
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1831949 Sample: ionetworks.mpsl.elf Startdate: 13/12/2025 Architecture: LINUX Score: 100 92 us-qrl.miningocean.org 15.204.240.197, 3333, 56264 HP-INTERNET-ASUS United States 2->92 94 193.35.154.205, 282, 3344, 45104 AS43260TR Bulgaria 2->94 96 3 other IPs or domains 2->96 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 108 10 other signatures 2->108 15 dash rm ionetworks.mpsl.elf 2->15         started        18 dash rm 2->18         started        20 dash head 2->20         started        22 8 other processes 2->22 signatures3 106 Detected Stratum mining protocol 92->106 process4 signatures5 114 Opens /proc/net/* files useful for finding connected devices and routers 15->114 116 Sample deletes itself 15->116 24 ionetworks.mpsl.elf 15->24         started        process6 process7 26 ionetworks.mpsl.elf 24->26         started        process8 28 ionetworks.mpsl.elf sh 26->28         started        30 ionetworks.mpsl.elf sh 26->30         started        32 ionetworks.mpsl.elf sh 26->32         started        34 3 other processes 26->34 process9 36 sh xmrigDaemon 28->36         started        38 sh curl 28->38         started        41 sh curl 28->41         started        51 5 other processes 28->51 43 sh service systemctl 30->43         started        45 sh useradd 32->45         started        47 sh passwd 32->47         started        49 sh 32->49         started        53 3 other processes 34->53 file10 55 xmrigDaemon sh 36->55         started        88 /xmrigDaemon, ELF 38->88 dropped 90 /xmrigMiner, ELF 41->90 dropped 57 service 43->57         started        59 service basename 43->59         started        61 service basename 43->61         started        63 service systemctl 43->63         started        65 useradd pam_tally2 45->65         started        67 useradd 45->67         started        69 useradd 45->69         started        71 4 other processes 45->71 process11 process12 73 sh xmrigMiner 55->73         started        76 service systemctl 57->76         started        78 service sed 57->78         started        signatures13 112 Sample reads /proc/mounts (often used for finding a writable filesystem) 73->112 80 xmrigMiner 73->80         started        process14 signatures15 98 Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher) 80->98 83 xmrigMiner sh 80->83         started        process16 process17 85 sh modprobe 83->85         started        signatures18 110 Tries to load the MSR kernel module used for reading/writing to CPUs model specific register 85->110
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4/
Verdict:
Malicious
Threat:
Family.GAFGYT
Link:
https://tip.neiki.dev/file/fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4
Threat name:
Linux.Backdoor.Gafgyt
Create hunting rule
Status:
Malicious
First seen:
2025-12-12 11:09:12 UTC
File Type:
ELF32 Little (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7px7yz4lheytatmvta54lwoyc7itfigf2proep2ke7sqdl5gmpsa._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt
Link:
https://tria.ge/reports/251213-c2964abw9a/
Malware Config
C2 Extraction:
193.35.154.205:282
Verdict:
Malicious
Tags:
trojan gafgyt Unix.Dropper.Mirai-7139229-0
YARA:
Linux_Trojan_Gafgyt_28a2fe0c Linux_Gafgyt_May_2024
Link:
https://app.threat.zone/submission/ecf55ceb-34e9-40e5-a176-f9ed5d7297e0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:Linux_Gafgyt_Generic
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Mirai/Gafgyt samples
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:Linux_Trojan_Gafgyt_28a2fe0c
Create hunting rule
Author:Elastic Security
Rule name:Mal_LNX_Gafgyt_Botnet_ELF
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect Gafgyt botnet, and there variants.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

elf fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3732599/
  
Delivery method
Distributed via web download

Comments