MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0894228dc08d24feaa0f0fd68999c2fad5562d10c10a109d1dd0417598bb11b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0894228dc08d24feaa0f0fd68999c2fad5562d10c10a109d1dd0417598bb11b5
SHA3-384 hash: 50e11eb00ac149440786ad49f32a97f2cb7700a76650189a94e8a7625d4ca7c25f43e3477915209319954bfaf86a9e79
SHA1 hash: 35fd34ffae2f0203af8506ee46fa898cee11ca90
MD5 hash: b59a41c37595bd1334b97d3c6f6c2770
humanhash: one-glucose-wisconsin-low
File name:sex.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'587 bytes
First seen:2025-05-13 20:03:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:q0FrV0FV0Flc43fX0FWeekX0F90FJX0Fme0FVfX0F10F1hl0F7aM0FRNWK0FnfrB:vr++lc4kWasWJsmbJse1hO7aFrK9
TLSH T13F3143CE22A54B70AC94AA6F31AAC84535DDF1C765EA1F5D2CEC38F5548DF15B000693
Magika shell
Reporter abuse_ch
Tags:gafgyt sh
URLMalware sample (SHA256 hash)SignatureTags
http://185.112.83.129/mips6c2ee8d063cef58ee749b49720bedd2118caf76814984543f7d597a75a89aaa5 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/mipsela16a028ad203ac4b0befac274acf85188b35ff384f8523491eff21215baaa6f3 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/sh4c3199f69756b04d884b11b603493d351c45882996ef157eda8afff314a56008a Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/x8676a75091cca4fb6fdcd7be35483b87a410018fdee0b7b18f67e6be47d398bb8d Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/arm61cac5cff36f70ba090c4a3813a637753cc1df574bac9e77063d1793fdb9626bb3 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/i68679607790181a99872404d10746f3a1af56e35e765cf7b5f5cc6c6e1f98e5c98b Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/ppc6013868712b5796d1abc917c8ef745f2af6dcb80324bc37c1485af516e03b3da Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/5869ebfaad779077adb8fd3842ea4bf07a817858d675ce3ea1f6dc7231265f90444 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/m68k1e39836f4c38ba0321f719952efebaa7b58ffa3c878409221543c5567f194f46 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/dcn/an/an/a
http://185.112.83.129/dssc9a944bf6439e5b8fd51684d714585d746620799841bd1edadef8c11cbf64ff4 Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/co4153c92003eb618c248a36e6717d4f9e61e9b6678e0abd0d9d1a2ddb98cd04fe Gafgytcensys elf gafgyt ua-wget
http://185.112.83.129/scarn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6823a7064a59e5a2ce0455a5linux22vpnfull_triage
Tags:
trojan agent virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive lolbin mirai remote
Link:
https://www.filescan.io/uploads/6823a5cb0e63989625832b2e/reports/a78709e7-b954-4b36-a25e-c21d63327c4e/overview
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0894228dc08d24feaa0f0fd68999c2fad5562d10c10a109d1dd0417598bb11b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0894228dc08d24feaa0f0fd68999c2fad5562d10c10a109d1dd0417598bb11b5/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-05-13 20:04:33 UTC
File Type:
Text (Shell)
AV detection:
24 of 36 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bckcfdoarusp5kqpb7litgoc7lkvmliqyefbbhi52baxlgf3cg2q._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/250513-ytdntagm71/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
File and Directory Permissions Modification
Executes dropped EXE
Detected Gafgyt variant
Gafgyt family
Gafgyt/Bashlite
Malware Config
C2 Extraction:
5.252.177.70:23
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 0894228dc08d24feaa0f0fd68999c2fad5562d10c10a109d1dd0417598bb11b5

(this sample)

Gafgyt

elf 6c2ee8d063cef58ee749b49720bedd2118caf76814984543f7d597a75a89aaa5

  
URLhaus
https://urlhaus.abuse.ch/url/3542891/
  
Delivery method
Distributed via web download
  
Dropping
MD5 3c7d8a59a0df6141e3f7a8b377781d35
  
Dropping
SHA256 6c2ee8d063cef58ee749b49720bedd2118caf76814984543f7d597a75a89aaa5

Comments