MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf
SHA3-384 hash:	f1e8d59fda1a9240bd117250d2e81ebe199ac142d35c1966fec6f55e06552523047469b6a2d99179c133de5d3cc9987d
SHA1 hash:	0e5533113cef49b8faaf283240760a601efa614f
MD5 hash:	0126a389136ade4b080af553900fd84e
humanhash:	four-cup-illinois-grey
File name:	handshakebins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	6'802 bytes
First seen:	2026-10-06 21:09:05 UTC
Last seen:	2026-10-07 11:39:50 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:Gvf+srLjrzrHCKxJDUWgyQEol8fHn4El2KxiX1Dl8pPeOKx+mqcl8z:juGL5l8wEAjDl8pPbzcl8z
TLSH	T156E1C3D721A708702DE0E82B72BB5C0475E9A59F40E6AF896EEC3CF951CDD48B090793
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.232.114.14/telnetd	eff4cbad70d1a0cbf9c296ebb2ea16e25cf52cb961b278501081bd6a376f1652	Gafgyt	gafgyt mirai
http://213.232.114.14/telnet	20d4672f40c452d53b41227f669c481703677e302954c52158515f7003d2fb27	Gafgyt	gafgyt mirai
http://213.232.114.14/kworker	591e135c571321fed659c2d5a763a4685333e2b1bccd35d19e51a1196878c01f	Mirai	gafgyt mirai
http://213.232.114.14/sshd	990b3aad88cb9453a0d2d83ce8c203259811e59f44dda1e720eb576c17c87177	Mirai	mirai
http://213.232.114.14/bash	f64e69b29a732cad6a023c77ba8dff6bd35fc0afef35364b367e6cd30f4b216b	Mirai	cowrie honeypot loader-payload mirai
http://213.232.114.14/getty	7b014d383cfedd8877dab5fe084f299999a054838a13cbb82d3b5ef34f29ed9d	Mirai	cowrie honeypot loader-payload mirai
http://213.232.114.14/kernal	b98a0909267bca4d6296b544d4463e00f28f38099dd4504df1c6cdeac15a760f	Mirai	cowrie gafgyt honeypot loader-payload mirai
http://213.232.114.14/gnome	e634abc411327b6c0f341f88838a443a227419ef1d75244fe3ce5c1596e7a0b2	Mirai	cowrie honeypot loader-payload mirai
http://213.232.114.14/ntp	b9e000d1cdebfa6c3073cbddabcfe80095a8d20d85a4f092b7424298ebdfb709	Mirai	cowrie honeypot loader-payload mirai
http://213.232.114.14/ext4	28b118cbb01f794509e1bd9af0cc62ea70c7cc71708f49817a3da4a0c27e6499	Mirai	cowrie gafgyt honeypot loader-payload mirai
http://213.232.114.14/watchdogd	2dbd3724d1916594b4e77c983474027fa4f629d8d6195e3b54cda76f534a6cda	Mirai	cowrie gafgyt honeypot loader-payload mirai
http://213.232.114.14/systemd	6c81eb4643cb5dd3172fa1df1361c1cadfbec280391e36ac71c335da1b5c1306	Mirai	cowrie gafgyt honeypot loader-payload mirai
http://213.232.114.14/ntpd	b1bd44dc2bc7afee87112216650fbabc75940fa1a3fc9dc30d8dcc9c53f11c0c	Mirai	cowrie honeypot loader-payload mirai
http://213.232.114.14/login	n/a	n/a	n/a
http://213.232.114.14/dbus	n/a	n/a	n/a
http://213.232.114.14/kde	n/a	n/a	n/a
http://213.232.114.14/crypto	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31067.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash busybox evasive lolbin

Link:

https://www.filescan.io/uploads/6ac5637bdd4be2b274541b79/reports/769f4b77-a81e-4f90-933b-a385966c27bc/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-06T12:48:00Z UTC

Last seen:

2026-10-07T09:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2cbddafa-f4c5-455b-9ed6-78e2400e7cc0

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-10-06 17:36:54 UTC

File Type:

Text (Shell)

AV detection:

22 of 38 (57.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b6wqbxpmc23h6mjrvjhp767dfv4pzilyib4jleqlovewm7l3x67q._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt antivm botnet defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/261006-zzjbxswyat/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Reads system network configuration

Modifies Bash startup script

Creates a large amount of network flows

Creates/modifies Cron job

Creates/modifies environment variables

Enumerates running processes

Modifies init.d

Modifies rc script

Modifies systemd

Reads system routing table

Schedules an At job

File and Directory Permissions Modification

Executes dropped EXE

Detected Gafgyt variant

Family: Gafgyt/Bashlite

Malware Config

C2 Extraction:

64.89.161.96:55487

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0fad00ddec16/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.93

Link:

https://yomi.yoroi.company/submissions/0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Sample_Unique_586960df Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	586960df8bf559ffbba600f11917a99baed4a875cb7faa5eabc060bcde67277b.sh