- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
c2b246d6b5280dfe29dd5b8dc3f053f8c4bc5a00ef5bd5a466415336be7f64ca- SHA1
41d1513312fc3b9717c6b47768ecf8242f7ea367- MD5
4796b067f81df373379fb78be97cf1e3- Filename
- c2b246d6_armv7l.elf.bin
- File type
- elf
- MIME
- application/x-elf
- File size
- 216876
- TLSH
T115240A9775B6A590C9E488B9B25882FC7347C3EA83FEB50CCE168D60E94E504693D7C3- SSDEEP
3072:4lswGNemOrNbqb4G+HVwtWyw+ArTMc6qNvVFHhRugUth:6O4G+17L+A/9dFigy
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 11. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 33%.
Confidence signal
VirusSign reports 99% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections33%
VirusSign confidence99%
Relationship context11 visible
Threat classificationgafgyt
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
33%
high
elf
216876 bytes
drops
Filename
c2b246d6_armv7l.elf.bin
Family
gafgyt
Type
trojan
File type
elf
MIME
application/x-elf
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
5%
low
69200 bytes
contains
Filename
b8a74c37_.rodata.bin
Family
agentlinux
MIME
application/octet-stream
Size
69200
SHA1
9d47ac49ae125b2643e0368d9175040f9d41770a
33%
high
elf
216876 bytes
drops
Filename
c2b246d6_armv7l.elf.bin
Family
gafgyt
Type
trojan
File type
elf
MIME
application/x-elf
0%
text
32 bytes
drops
Filename
f4aed929_guardian.bin
File type
text
MIME
text/plain
Size
32
SHA1
0ecac14419d44be2d7607bf12fc0de100c5a8c72
0%
ini
153 bytes
drops
Filename
74977bd1_guardian.service.bin
File type
ini
MIME
text/plain
Size
153
SHA1
2c22bcf27044bec4f267f56037b560983fca22e4
0%
text
49 bytes
drops
Filename
236b0360_rc.local.bin
File type
text
MIME
text/plain
Size
49
SHA1
1a96f066783315604e9c5602a52e0705df8a7477
Related IPs
Network IPs associated with this indicator.
5shown
US
communicates
CIDR
136.176.185.0/24
Network
136.176.185.0-136.176.185.255
First seen
2026-11-05T16:18:58Z
Last seen
2026-11-05T20:46:35Z
GB
communicates
CIDR
135.3.0.0/16
Network
135.3.0.0-135.7.255.255
First seen
2026-11-05T16:18:58Z
Last seen
2026-11-05T20:46:35Z
AU
communicates
CIDR
134.178.0.0/16
Network
134.178.0.0-134.178.255.255
First seen
2026-11-05T16:18:58Z
Last seen
2026-11-05T20:46:35Z
US
communicates
Network
134.14.0.0-134.14.255.255
First seen
2026-11-05T16:18:58Z
Last seen
2026-11-05T20:46:35Z
CA
communicates
CIDR
132.208.0.0/14
Network
132.211.0.0-132.211.255.255
First seen
2026-11-05T16:18:58Z
Last seen
2026-11-05T20:46:35Z
Analysis details
Severity: hightrojanpersistencearmprocess-renameelfdebug-checkexecutionmiraiminerdefense-evasiondiscovery
Freshness: Recent · Last seen 8 days ago.
- Detection rate
- 33%
- Threat type
- trojan
- Family
- gafgyt
- Confidence
- 99%
- detection
- 33 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
c2b246d6b5280dfe29dd5b8dc3f053f8c4bc5a00ef5bd5a466415336be7f64ca- SHA1
41d1513312fc3b9717c6b47768ecf8242f7ea367- MD5
4796b067f81df373379fb78be97cf1e3- Filename
- c2b246d6_armv7l.elf.bin
- File type
- elf
- MIME
- application/x-elf
- File size
- 216876
- TLSH
T115240A9775B6A590C9E488B9B25882FC7347C3EA83FEB50CCE168D60E94E504693D7C3- SSDEEP
3072:4lswGNemOrNbqb4G+HVwtWyw+ArTMc6qNvVFHhRugUth:6O4G+17L+A/9dFigy- First seen
- 2026-11-05T16:08:44Z
- Last seen
- 2026-11-05T20:46:32Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 11. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 33%.
Confidence signal
VirusSign reports 99% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family gafgyt.
Relationship context
11 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
10 timestamped observations are arranged from 2026-10-20 to 2026-11-05. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family gafgyt.
Last seen 8 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- c2b246d6_armv7l.elf.bin
- File type
- elf
- MIME
- application/x-elf
- Size
- 216876
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Classification label
- Connects to IPs without corresponding DNS lookups
- Creates hidden files and/or directories
- Creates hidden files without content (potentially used as a mutex)
- Detected TCP or UDP traffic on non-standard ports
5 shown
View MITRE ATT&CK details · 5 shown
- T1564 — Creates hidden files without content (potentially used as a mutex)Tactics: TA0005
- T1564.001 — Creates hidden files, links and/or directoriesTactics: TA0005
- T1571 — Detected TCP or UDP traffic on non-standard portsTactics: TA0011
- T1036 — Drops files in suspicious directoriesTactics: TA0005
- T1003 — Enumerates processes within the "proc" file systemTactics: TA0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCPports 23, 2323, 5555
- 5+ outbound connections observed
- 0 domains, 5+ IPs, 0 URLs
- Common ports: 23, 2323, 5555, 8443, 9111
- Protocols: TCP
View details · 5 shown
- IP
- 31.56.209.86
- Port
- 9111
- Protocol
- TCP
- IP
- 98.102.175.170
- Port
- 8443
- Protocol
- TCP
- IP
- 98.102.175.170
- Port
- 5555
- Protocol
- TCP
- IP
- 98.102.175.170
- Port
- 2323
- Protocol
- TCP
- IP
- 98.102.175.170
- Port
- 23
- Protocol
- TCP
5 shown
C2 candidates1
TCPports 9111
- 1 C2 candidate communications
- 0 domains, 1 IPs
- Common ports: 9111
- Protocols: TCP
View details · 1 shown
- IP
- 31.56.209.86
- Port
- 9111
- Protocol
- TCP