MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187
SHA3-384 hash: bde50eee0cfa86ca7657e4ff26bdf0650cf344fc244c0a0f4f26fc7954c3c70d11e8f181ec5bf4c673d9dcedb8190813
SHA1 hash: f36f1da8b77fe11f55e554d04ee3c2b0e85a9059
MD5 hash: 49be89adb6fecae36a66c9ba826ad406
humanhash: october-fish-ceiling-south
File name:Sakura.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:2'153 bytes
First seen:2025-12-06 19:26:17 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 48:14dd8R4mRttQdM47g4Eb4Yp4xTu4h24Tw4mL34M5v4Tw4u74vT:14dd8R4MttQdM47g4Eb4Yp4xTu4h24Td
TLSH T1A8418ACB50910BF7ACA0A833B76549A4FCD0A09694C15F462EDC3CD54CAFDECB819683
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://108.136.241.40/m-i.p-s.Sakuraf2bd4a9ed8666dc4a1c7b0baa5cce122fad87ad915e6f4052fcaab678611ef31 Gafgytgafgyt mirai opendir
http://108.136.241.40/m-p.s-l.Sakura2d49b935c8be0b3436b9afda72f8b61736e8245b62d4047d25f75f27c39a7249 Gafgytgafgyt mirai opendir
http://108.136.241.40/s-h.4-.Sakura4d6b4e747cc13d9ed89873736d6c69772389b8d13448ec6493d62312295dafe3 Gafgytgafgyt mirai opendir
http://108.136.241.40/x-8.6-.Sakurac5928679dd8a4cc007d2155284d8a03f3d2005fc652edfec55545131822bf424 Gafgytgafgyt mirai opendir
http://108.136.241.40/a-r.m-6.Sakura288e6fc449440a9246db99f3713560c1f07f3f2af706116b956c4f3375b16221 Gafgytgafgyt mirai opendir
http://108.136.241.40/x-3.2-.Sakura3631b17e11c957f5817773d55d2b6bb17be668252648728ce2c392ce2d90755d Gafgytgafgyt mirai opendir
http://108.136.241.40/a-r.m-7.Sakura2cba2be6712fadce3c5cea9e12ba5187be3f59e52f684d2e8ab9c178e587636a Gafgytgafgyt mirai opendir
http://108.136.241.40/p-p.c-.Sakura800765492fdb6e8c32c45872c83b24cf9b783f1d89253a764df4e72c47957cea Gafgytgafgyt mirai opendir
http://108.136.241.40/i-5.8-6.Sakura37fb3b56f920f1885091d45aded5b0dcfa74360fd760062f0c1df98d8047746a Gafgytgafgyt mirai opendir
http://108.136.241.40/m-6.8-k.Sakura271fcd3c47cc6c1ffdedf78bed72983e193d0072fd6eeb9b6e57945a5a0034a8 Gafgytgafgyt mirai opendir
http://108.136.241.40/a-r.m-4.Sakura800765492fdb6e8c32c45872c83b24cf9b783f1d89253a764df4e72c47957cea Gafgytgafgyt mirai opendir
http://108.136.241.40/a-r.m-5.Sakura19c840622d92b3183641974a87ddb0d25129c8b017b354d591b1bd3fde1b0f31 Gafgytgafgyt mirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive medusa mirai
Link:
https://www.filescan.io/uploads/69348392bc15eab491f5fdac/reports/a20c2196-6bfb-4961-a45c-ceb6e2af1f5d/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-07T01:54:00Z UTC
Last seen:
2025-12-07T02:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-12-06 19:27:30 UTC
File Type:
Text (Shell)
AV detection:
15 of 24 (62.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=crbheuj5wrzc6g6ndb4icvb4dgxoy556jrnlido2p3uw64ikcgdq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251206-x5xemasjf1/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187

(this sample)

Gafgyt

elf f2bd4a9ed8666dc4a1c7b0baa5cce122fad87ad915e6f4052fcaab678611ef31

  
URLhaus
https://urlhaus.abuse.ch/url/3728014/
  
Delivery method
Distributed via web download
  
Dropping
MD5 1847b753a4c31ad6a6b3f2166f41e5d3
  
Dropping
SHA256 f2bd4a9ed8666dc4a1c7b0baa5cce122fad87ad915e6f4052fcaab678611ef31

Comments