MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81
SHA3-384 hash:	7924b26d3573a0a7fe949e8f6efa12196918f44451c76fc3a2d97803fec517eceae8037a6da4815b83b2ff20928ff79c
SHA1 hash:	0869f2e35abc758ccdf40cd59a40d01c11f45927
MD5 hash:	e8d7d61d9c01c6cdf287caf9347e1a48
humanhash:	berlin-burger-colorado-nineteen
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'080 bytes
First seen:	2026-10-03 16:57:18 UTC
Last seen:	2026-10-03 21:52:48 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0F2kV3sbVHW0F2govvo0F24tDX0F2JgfX0F2RzB+RFX0F4DO0F2WNI3ewkX0F2c:vKVeJbI/s+VG+4DLTNIpks2K7
TLSH	T10B1121D651E10A36AC64D877B4AF4CE834D0E4C644E57F0818EC38F5648DE49F481B93
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.168.4.206/dissmips	65988926d1a02d38a6c08ee0e0dbb966dabcb337aff3344c635fd53e43512d8d	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissmpsl	2fbd50ef3b12511425f2ee45e07b39c11fa261953ebfec45d4a31426148320fa	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/disssh4	35e9f2443d7fa3c500ab7be64d9ffb5f90fd30453f4e4d3adfe43b6ecce8330e	Mirai	censys elf mirai ua-wget
http://104.168.4.206/dissx86	b9b00a11b0bdecee5e9e1a56a89611267cc5881b258196e4df6166372ba1ea98	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm4	d849fb8000891cf3cca1b755eac2eda328135ae73041cfcd6f7eb612f6b9ab20	Gafgyt	censys elf gafgyt mirai ua-wget
http://104.168.4.206/adissarm5	d9a4f09acbe5baf37d129ddc8a22c25a2fb42c3437667ad676ea3a08e4d0371c	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm6	1fdac0e0f2fda9d161056beab78fa1c4fc82216e1158eeb8ecabc643139a7fc3	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm7	8d88cda5439279eb70e789a8718f8f27a40d328bc674d6d5197731935dbd16a5	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ac133fa950162c4371385d8/reports/98fc8df1-5d68-43c8-837b-2454fe750b3d/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-03T06:17:00Z UTC

Last seen:

2026-10-04T19:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e4cb417e-34c3-423f-94c8-a18ad208041f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-03 11:14:51 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmbpejcfar6676vg74wfrop4rzsstw6kvymezdjwoplxzdzhloaq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261003-vgrhcsvsgs/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh