MALICIOUS — 0020d6a69202ba61f8a7ff6cc2c332ac297b8761e1a1fde9d658c88085791a62.elf
MALICIOUS — 0020d6a69202ba61f8a7ff6cc2c332ac297b8761e1a1fde9d658c88085791a62.elf is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Gafgyt family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0020d6a69202ba61f8a7ff6cc2c332ac297b8761e1a1fde9d658c88085791a62 - SHA-1:
40581e37ac754df00ba5b987944c2a03e1c7b00b - MD5:
b43109c24e1b31a9b931a1b790335081 - ssdeep:
6144:oJHPlLXR2dShcL9rxYlBde+39KlduQ+NGoLULhfjDNHG:25XRhhM9rxYlBA+32duLK1rDN - TLSH:
T16D441A21EAAA2066FC3946DC8C98413C10CD475D4E2CDFF9CEDA9DF68849A931C714E6 - Submitted as: 0020d6a69202ba61f8a7ff6cc2c332ac297b8761e1a1fde9d658c88085791a62.elf
- File type: elf · Size: 256776 bytes
- Verdict: malicious (98/100) · Family: Gafgyt
Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified
Detections (6 of 53 engines)
- ClamAV (daily): Unix.Trojan.Mirai-9924065-0
- YARA: Intezer community: INTEZER_Linux_XMRig_Miner
- YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
- Microsoft Defender: Backdoor:Linux/Gafgyt.BA!xp
- Emsisoft (Emergency Kit): Gen:Variant.Linux.DDoS.2
- Kaspersky (KVRT): HEUR:Backdoor.Linux.Gafgyt.fz
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Unix.Trojan.Mirai-9924065-0 (rule
Unix.Trojan.Mirai-9924065-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Linux/Gafgyt.BA!xp (rule
Backdoor:Linux/Gafgyt.BA!xp) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Linux.DDoS.2 (rule
Gen:Variant.Linux.DDoS.2) - engine signal, weight 0.55, confidence 0.85 - YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule
INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule
STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 8.8.8.8, 8.8.4.4, 1.1.1.1 - static signal, weight 0.35, confidence 0.60
- Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
866 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 48.211.4.16 US · Ashburn · AS8075 Microsoft Limited
- ff02::1:3
- 224.0.0.252
- 224.0.0.251
- ff02::fb
- 10.240.0.255
- 10.240.0.1
- ff02::16
- 10.240.0.77
- 20.42.73.26 US · Ashburn · AS8075 Microsoft Corporation
- 4.247.188.233 IN · Pune · AS8075 Microsoft Corporation
- 185.125.190.57
- 23.40.52.123
Dropped files
- tmp_tmp.bMMLUKa5AJ -
fc3f058db9d5003f7c5d1671bc8545e5aa3bc8532c7348304e769513a80358d8
Embedded domains
- isc.org
- cloudflare.com
- ripe.net
- microsoft.com
- akamai.com
- socket.io
- s.sh
- loader.sh
Embedded IP addresses
- 8.8.8.8
- 8.8.4.4
- 1.1.1.1
- 1.0.0.1
- 9.9.9.9
- 208.67.222.222
- 208.67.220.220
- 4.2.2.1
- 4.2.2.2
- 4.2.2.3
- 4.2.2.4
- 4.2.2.5
- 4.2.2.6
- 209.244.0.3
- 209.244.0.4
- 64.6.64.6
- 64.6.65.6
- 77.88.8.8
- 77.88.8.1
- 162.159.200.1
- 162.159.200.123
- 216.239.35.0
- 216.239.35.4
- 216.239.35.8
- 216.239.35.12
More Gafgyt samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report