MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688
SHA3-384 hash:	2dc78421accc1ad068c2e37b08f15abb18542bf83fac45c6b8b1d24475cd56636a4d09f86d6e77c6d0ef824769c768b6
SHA1 hash:	3a68c4ced396c297166304c7a64fb27d2e5db407
MD5 hash:	8b1a4d37929afc56a55341907d12da7b
humanhash:	vegan-seventeen-sodium-october
File name:	logsbins.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	4'522 bytes
First seen:	2025-08-26 20:40:16 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vI2rI0IYIQzIlxMlFIEIQIoIu3IUIoI4IFZc2bBeQXclxMl1dZguZx7XyU2bUOUf:vxR1dJJ9thBFtG3mp51dhBNj5Jn51dk
TLSH	T12191FDCBB1721B312A90E99F3276451875E4A0C644D7CFD468ED39F980CCE887826EB7
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

43

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5d2edaf6-7854-4a70-80a0-63f630e7a613

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688/

ReversingLabs TitaniumCloud Linux.Downloader.Morila

Threat name:

Linux.Downloader.Morila

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-26 20:41:42 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bs6kipylkjgnjyy67miyrhccqlxtiwfzjzlelkwou2haxorik2ea._file

Hatching Triage gafgyt

Result

Malware family:

gafgyt

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gafgyt antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250826-zgb5wssxgs/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

VMRay Xorbot

Malware family:

Xorbot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0cbca43f0b52/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.59

Link:

https://yomi.yoroi.company/submissions/0cbca43f0b524cd4e31efb11889c4282ef3458b94e5645aacea68e0bba285688