MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364
SHA3-384 hash:	75beabcb6a9411e39cb59ae70dc53ef636331ea68c7ba4580e3eecfe0ee6137ee1177e75daf20c09a0667b0e63cd9831
SHA1 hash:	16f20ebabbc17920f72bf8f9d5cff415cb31674f
MD5 hash:	8bd19cf91996109e61abf1c438c39766
humanhash:	spring-south-sad-fish
File name:	utt
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'191 bytes
First seen:	2025-08-16 14:11:25 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:E22IbO5zOt+MB0hQUQ7k1VOpOmk1VYfk1VDvDgk1VYZ1Hk1VlSkx:EAO5CEA0it7k10k1kk1FLgk1eZBk1Okx
TLSH	T191219DCF11918861DC5C998DB6430C18A4CEC9D529CFCE8CE7CD8536D8C9E0835A1F69
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.51.126.131/t/armv4l	51dbfe5eb3331858e57320a5a2327599fc51d18bab6c76c5d7cb03ca4621078b	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/armv5l	de0a93c843a18ba73b472730753ebd5d796d497f4c0b7533872aadce221f5d80	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/armv7l	e3f59d94764653bbc6887c32ca43edcb670626c10502195d206f308b0684d428	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/powerpc	1564e24be14f2274b7827ef5ac78e442db334fbdf15e73a171dc6cf5186c3741	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/mips	6039ff1c2c6d9a8675c66655fa98c08b461c5ed90b33de19648689c27a7a7756	Gafgyt	elf gafgyt ua-wget
http://158.51.126.131/t/mipsel	48ec5f07842eb9840058755d90325aa23cdd67dca0f23c08faf79ea67918251d	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/68a09191abfbaec31823f379/reports/a6cb58e6-1554-4136-abcd-ed8df15a8b3e/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1ca86501-297b-4828-b68d-464a67c99c74

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364/

Verdict:

Malicious

Threat:

HEUR:Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364

Threat name:

Script-Shell.Trojan.Heuristic

Status:

Malicious

First seen:

2025-08-16 05:50:40 UTC

File Type:

Text (Shell)

AV detection:

8 of 38 (21.05%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dninq2et6uau4v2yx6jku47ryxrpps7h6y2ckyhqsskkuwos6nsa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250816-rj7etaxrt9/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1b50d86893f5014e5758bf92aa73f1c5e2f7cbe7f6342560f09494aa59d2f364

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.