🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d
SHA3-384 hash: e3e022435f0c2021e98ddd2510541e6e7a3de27a6fdafddb23660713e7acfc9c103dbbf66b20d20d75d6ec4a56075bfc
SHA1 hash: 4ade3eed2f5fac43fedb497e9b5722aa5dc368b9
MD5 hash: 624bde4f3e00015b838ce1d763191272
humanhash: louisiana-carpet-papa-lake
File name:SnOoPy.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:2'111 bytes
First seen:2026-11-03 18:12:06 UTC
Last seen:2026-11-05 18:52:31 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:q0FJ5ew0FHo0w8SA0F9H90Fqoj0FiIqs0Fwm0FiIkq0FS2/0F/n0FPX0FS2/0FiN:vJAhHo0dSxIqogihwTilSj/8PsSjipiy
TLSH T115413C8BE1914DF02C94D55733F9484030D8A0CEA6D69F0FA9DEFBE9488DEC8B605693
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Jerry1113
Tags:cowrie gafgyt honeypot sh
URLMalware sample (SHA256 hash)SignatureTags
http://181.214.147.11/m-i.p-s.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/m-p.s-l.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/s-h.4-.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/x-8.6-.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/a-r.m-6.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/x-3.2-.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/a-r.m-7.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/p-p.c-.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/i-5.8-6.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/m-6.8-k.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/a-r.m-4.SNOOPYn/an/abotnet cowrie
http://181.214.147.11/a-r.m-5.SNOOPYn/an/abotnet cowrie

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6aea23f96cee5dbde995fb09/reports/cb868a1d-ecfb-47bf-8769-d576c5418533/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-11-03T16:19:00Z UTC
Last seen:
2026-11-04T09:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/801af99f-1fe0-4bd4-b1da-0988fc96780d
Behavior Graph:
Download SVG
%3 guuid=7c9b96a8-1b00-0000-5dc9-9b73a5090000 pid=2469 /usr/bin/sudo guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481 /tmp/sample.bin guuid=7c9b96a8-1b00-0000-5dc9-9b73a5090000 pid=2469->guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481 execve guuid=0681c6ae-1b00-0000-5dc9-9b73b5090000 pid=2485 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=0681c6ae-1b00-0000-5dc9-9b73b5090000 pid=2485 execve guuid=c2ffb6c4-1b00-0000-5dc9-9b73de090000 pid=2526 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=c2ffb6c4-1b00-0000-5dc9-9b73de090000 pid=2526 execve guuid=a01a43c5-1b00-0000-5dc9-9b73e1090000 pid=2529 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=a01a43c5-1b00-0000-5dc9-9b73e1090000 pid=2529 clone guuid=7a61fcc5-1b00-0000-5dc9-9b73e5090000 pid=2533 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=7a61fcc5-1b00-0000-5dc9-9b73e5090000 pid=2533 execve guuid=479651c6-1b00-0000-5dc9-9b73e7090000 pid=2535 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=479651c6-1b00-0000-5dc9-9b73e7090000 pid=2535 execve guuid=dba49dd1-1b00-0000-5dc9-9b73ff090000 pid=2559 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=dba49dd1-1b00-0000-5dc9-9b73ff090000 pid=2559 execve guuid=2b7279d2-1b00-0000-5dc9-9b73020a0000 pid=2562 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=2b7279d2-1b00-0000-5dc9-9b73020a0000 pid=2562 clone guuid=0c6ed2d4-1b00-0000-5dc9-9b73080a0000 pid=2568 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=0c6ed2d4-1b00-0000-5dc9-9b73080a0000 pid=2568 execve guuid=203681d5-1b00-0000-5dc9-9b730a0a0000 pid=2570 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=203681d5-1b00-0000-5dc9-9b730a0a0000 pid=2570 execve guuid=a7dd92e2-1b00-0000-5dc9-9b73220a0000 pid=2594 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=a7dd92e2-1b00-0000-5dc9-9b73220a0000 pid=2594 execve guuid=29690ae3-1b00-0000-5dc9-9b73240a0000 pid=2596 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=29690ae3-1b00-0000-5dc9-9b73240a0000 pid=2596 clone guuid=60654ce4-1b00-0000-5dc9-9b732a0a0000 pid=2602 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=60654ce4-1b00-0000-5dc9-9b732a0a0000 pid=2602 execve guuid=a744c9e4-1b00-0000-5dc9-9b732c0a0000 pid=2604 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=a744c9e4-1b00-0000-5dc9-9b732c0a0000 pid=2604 execve guuid=55801bf1-1b00-0000-5dc9-9b73400a0000 pid=2624 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=55801bf1-1b00-0000-5dc9-9b73400a0000 pid=2624 execve guuid=4c182bf2-1b00-0000-5dc9-9b73410a0000 pid=2625 /tmp/x-8.6-.SNOOPY net guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=4c182bf2-1b00-0000-5dc9-9b73410a0000 pid=2625 execve guuid=3485f0f2-1b00-0000-5dc9-9b73440a0000 pid=2628 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=3485f0f2-1b00-0000-5dc9-9b73440a0000 pid=2628 execve guuid=e80aedf3-1b00-0000-5dc9-9b73480a0000 pid=2632 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=e80aedf3-1b00-0000-5dc9-9b73480a0000 pid=2632 execve guuid=dcdc1d02-1c00-0000-5dc9-9b73530a0000 pid=2643 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=dcdc1d02-1c00-0000-5dc9-9b73530a0000 pid=2643 execve guuid=4f27a302-1c00-0000-5dc9-9b73550a0000 pid=2645 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=4f27a302-1c00-0000-5dc9-9b73550a0000 pid=2645 clone guuid=7ae89103-1c00-0000-5dc9-9b73590a0000 pid=2649 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=7ae89103-1c00-0000-5dc9-9b73590a0000 pid=2649 execve guuid=eb880804-1c00-0000-5dc9-9b735b0a0000 pid=2651 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=eb880804-1c00-0000-5dc9-9b735b0a0000 pid=2651 execve guuid=b9ea0611-1c00-0000-5dc9-9b73690a0000 pid=2665 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=b9ea0611-1c00-0000-5dc9-9b73690a0000 pid=2665 execve guuid=eb4f1a12-1c00-0000-5dc9-9b736c0a0000 pid=2668 /tmp/x-3.2-.SNOOPY net guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=eb4f1a12-1c00-0000-5dc9-9b736c0a0000 pid=2668 execve guuid=17425713-1c00-0000-5dc9-9b73710a0000 pid=2673 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=17425713-1c00-0000-5dc9-9b73710a0000 pid=2673 execve guuid=d7b2b913-1c00-0000-5dc9-9b73730a0000 pid=2675 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=d7b2b913-1c00-0000-5dc9-9b73730a0000 pid=2675 execve guuid=e4ae891f-1c00-0000-5dc9-9b738a0a0000 pid=2698 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=e4ae891f-1c00-0000-5dc9-9b738a0a0000 pid=2698 execve guuid=e0b47e20-1c00-0000-5dc9-9b738e0a0000 pid=2702 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=e0b47e20-1c00-0000-5dc9-9b738e0a0000 pid=2702 clone guuid=ca8adf21-1c00-0000-5dc9-9b73960a0000 pid=2710 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=ca8adf21-1c00-0000-5dc9-9b73960a0000 pid=2710 execve guuid=441b9222-1c00-0000-5dc9-9b73980a0000 pid=2712 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=441b9222-1c00-0000-5dc9-9b73980a0000 pid=2712 execve guuid=10fd9f2f-1c00-0000-5dc9-9b73b00a0000 pid=2736 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=10fd9f2f-1c00-0000-5dc9-9b73b00a0000 pid=2736 execve guuid=942e4730-1c00-0000-5dc9-9b73b10a0000 pid=2737 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=942e4730-1c00-0000-5dc9-9b73b10a0000 pid=2737 clone guuid=2fc88e31-1c00-0000-5dc9-9b73b60a0000 pid=2742 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=2fc88e31-1c00-0000-5dc9-9b73b60a0000 pid=2742 execve guuid=f9a52632-1c00-0000-5dc9-9b73b80a0000 pid=2744 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=f9a52632-1c00-0000-5dc9-9b73b80a0000 pid=2744 execve guuid=148f6d3e-1c00-0000-5dc9-9b73cf0a0000 pid=2767 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=148f6d3e-1c00-0000-5dc9-9b73cf0a0000 pid=2767 execve guuid=ae46d63e-1c00-0000-5dc9-9b73d10a0000 pid=2769 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=ae46d63e-1c00-0000-5dc9-9b73d10a0000 pid=2769 clone guuid=b812ea3f-1c00-0000-5dc9-9b73d30a0000 pid=2771 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=b812ea3f-1c00-0000-5dc9-9b73d30a0000 pid=2771 execve guuid=7c846a40-1c00-0000-5dc9-9b73d40a0000 pid=2772 /usr/bin/wget net send-data guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=7c846a40-1c00-0000-5dc9-9b73d40a0000 pid=2772 execve guuid=19cc9a46-1c00-0000-5dc9-9b73d50a0000 pid=2773 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=19cc9a46-1c00-0000-5dc9-9b73d50a0000 pid=2773 execve guuid=255c8b47-1c00-0000-5dc9-9b73d60a0000 pid=2774 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=255c8b47-1c00-0000-5dc9-9b73d60a0000 pid=2774 clone guuid=c536d547-1c00-0000-5dc9-9b73d70a0000 pid=2775 /usr/bin/rm guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=c536d547-1c00-0000-5dc9-9b73d70a0000 pid=2775 execve guuid=c1537348-1c00-0000-5dc9-9b73d80a0000 pid=2776 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=c1537348-1c00-0000-5dc9-9b73d80a0000 pid=2776 execve guuid=b13f4955-1c00-0000-5dc9-9b73d90a0000 pid=2777 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=b13f4955-1c00-0000-5dc9-9b73d90a0000 pid=2777 execve guuid=88e1c756-1c00-0000-5dc9-9b73da0a0000 pid=2778 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=88e1c756-1c00-0000-5dc9-9b73da0a0000 pid=2778 clone guuid=190ffc58-1c00-0000-5dc9-9b73dd0a0000 pid=2781 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=190ffc58-1c00-0000-5dc9-9b73dd0a0000 pid=2781 execve guuid=1bf45859-1c00-0000-5dc9-9b73e00a0000 pid=2784 /usr/bin/wget net send-data write-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=1bf45859-1c00-0000-5dc9-9b73e00a0000 pid=2784 execve guuid=8333d664-1c00-0000-5dc9-9b73f80a0000 pid=2808 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=8333d664-1c00-0000-5dc9-9b73f80a0000 pid=2808 execve guuid=37801965-1c00-0000-5dc9-9b73fa0a0000 pid=2810 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=37801965-1c00-0000-5dc9-9b73fa0a0000 pid=2810 clone guuid=bc35d065-1c00-0000-5dc9-9b73fd0a0000 pid=2813 /usr/bin/rm delete-file guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=bc35d065-1c00-0000-5dc9-9b73fd0a0000 pid=2813 execve guuid=ff4b4b66-1c00-0000-5dc9-9b73000b0000 pid=2816 /usr/bin/wget net send-data guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=ff4b4b66-1c00-0000-5dc9-9b73000b0000 pid=2816 execve guuid=7d84fc6b-1c00-0000-5dc9-9b73110b0000 pid=2833 /usr/bin/chmod guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=7d84fc6b-1c00-0000-5dc9-9b73110b0000 pid=2833 execve guuid=3e834b6c-1c00-0000-5dc9-9b73120b0000 pid=2834 /usr/bin/bash guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=3e834b6c-1c00-0000-5dc9-9b73120b0000 pid=2834 clone guuid=a52f656c-1c00-0000-5dc9-9b73140b0000 pid=2836 /usr/bin/rm guuid=a59e5dad-1b00-0000-5dc9-9b73b1090000 pid=2481->guuid=a52f656c-1c00-0000-5dc9-9b73140b0000 pid=2836 execve 37fef080-598d-5c12-81d6-1d353fd1add3 181.214.147.11:80 guuid=0681c6ae-1b00-0000-5dc9-9b73b5090000 pid=2485->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=479651c6-1b00-0000-5dc9-9b73e7090000 pid=2535->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=203681d5-1b00-0000-5dc9-9b730a0a0000 pid=2570->37fef080-598d-5c12-81d6-1d353fd1add3 send: 142B guuid=a744c9e4-1b00-0000-5dc9-9b732c0a0000 pid=2604->37fef080-598d-5c12-81d6-1d353fd1add3 send: 142B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=4c182bf2-1b00-0000-5dc9-9b73410a0000 pid=2625->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0003cdf2-1b00-0000-5dc9-9b73420a0000 pid=2626 /tmp/x-8.6-.SNOOPY guuid=4c182bf2-1b00-0000-5dc9-9b73410a0000 pid=2625->guuid=0003cdf2-1b00-0000-5dc9-9b73420a0000 pid=2626 clone guuid=aabfd7f2-1b00-0000-5dc9-9b73430a0000 pid=2627 /tmp/x-8.6-.SNOOPY net send-data zombie guuid=0003cdf2-1b00-0000-5dc9-9b73420a0000 pid=2626->guuid=aabfd7f2-1b00-0000-5dc9-9b73430a0000 pid=2627 clone 1bdc3093-32a1-5121-9188-c7bbcb90597f 181.214.147.11:999 guuid=aabfd7f2-1b00-0000-5dc9-9b73430a0000 pid=2627->1bdc3093-32a1-5121-9188-c7bbcb90597f send: 87740B guuid=e80aedf3-1b00-0000-5dc9-9b73480a0000 pid=2632->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=eb880804-1c00-0000-5dc9-9b735b0a0000 pid=2651->37fef080-598d-5c12-81d6-1d353fd1add3 send: 142B guuid=eb4f1a12-1c00-0000-5dc9-9b736c0a0000 pid=2668->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=475d3c13-1c00-0000-5dc9-9b736f0a0000 pid=2671 /tmp/x-3.2-.SNOOPY guuid=eb4f1a12-1c00-0000-5dc9-9b736c0a0000 pid=2668->guuid=475d3c13-1c00-0000-5dc9-9b736f0a0000 pid=2671 clone guuid=73574713-1c00-0000-5dc9-9b73700a0000 pid=2672 /tmp/x-3.2-.SNOOPY net send-data zombie guuid=475d3c13-1c00-0000-5dc9-9b736f0a0000 pid=2671->guuid=73574713-1c00-0000-5dc9-9b73700a0000 pid=2672 clone guuid=73574713-1c00-0000-5dc9-9b73700a0000 pid=2672->1bdc3093-32a1-5121-9188-c7bbcb90597f send: 85814B guuid=d7b2b913-1c00-0000-5dc9-9b73730a0000 pid=2675->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=441b9222-1c00-0000-5dc9-9b73980a0000 pid=2712->37fef080-598d-5c12-81d6-1d353fd1add3 send: 142B guuid=f9a52632-1c00-0000-5dc9-9b73b80a0000 pid=2744->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=7c846a40-1c00-0000-5dc9-9b73d40a0000 pid=2772->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=c1537348-1c00-0000-5dc9-9b73d80a0000 pid=2776->37fef080-598d-5c12-81d6-1d353fd1add3 send: 142B guuid=1bf45859-1c00-0000-5dc9-9b73e00a0000 pid=2784->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B guuid=ff4b4b66-1c00-0000-5dc9-9b73000b0000 pid=2816->37fef080-598d-5c12-81d6-1d353fd1add3 send: 143B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-11-03 18:13:15 UTC
File Type:
Text (Shell)
AV detection:
25 of 38 (65.79%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dojdm732ivh42czcn6b2o4on7s2yxajdm74wnt3ajxhsywvbpu6q._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/261103-ws75xsbv5x/
Behaviour
Writes file to tmp directory
Reads system network configuration
Reads system routing table
File and Directory Permissions Modification
Executes dropped EXE
Detected Gafgyt variant
Family: Gafgyt/Bashlite
Malware Config
C2 Extraction:
181.214.147.11:999
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 1b92367f7a454fcd0b226f83a771cdfcb58b812367f966cf604dcf2c5aa17d3d

(this sample)

  
Delivery method
Distributed via web download

Comments