MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa
SHA3-384 hash:	467a587190effaec5d4041e5532d888e2f3ad3cf68ecc6892433bfd86bfceeabc17571ffc663e83526769293371da3ba
SHA1 hash:	980fbbbe058f4af0764ef7c60ca1c01e05040452
MD5 hash:	488ed1889beeb0503f2ba5258bb3b790
humanhash:	cola-fanta-vegan-helium
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'404 bytes
First seen:	2026-10-07 16:04:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vKKVsAhbIIqg00CQWLRFEYaLEJMJ2NU3RsT7:vKKWebIIqg00CQWL0L+W2NU3RsT7
TLSH	T158414FDA11A2063AAC64F867B0FA4D6436D1E2C654D07F1928FD39F9688DF4CF484B93
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.168.4.206/dissmips	d56a165a4f18bdf0909917894b371c48410b64dac7b71751c71733c770c18e17	Gafgyt	censys elf gafgyt ua-wget
http://104.168.4.206/dlr.mips	b54bc89673ab79915e3170e804009bb5a725e34510ce62f836614a339ee04f12	Mirai	elf mirai ua-wget
http://104.168.4.206/dissmpsl	01a6d7a943d1287a48936923b86b46b6a5e094ac5cb8803510a2f408d36e6239	Gafgyt	censys elf gafgyt ua-wget
http://104.168.4.206/dlr.mpsl	4070339941818eaec7a12be25f6b144c7eaba05c194e107f111154adad7fd8bb	Mirai	elf mirai ua-wget
http://104.168.4.206/disssh4	37acbeb44033456803564707bcdc4ca78ff7d357577afea4dc6fb88a10c9682e	Mirai	censys elf mirai ua-wget
http://104.168.4.206/dlr.sh4	a034ecf08ffbe1edf05c172d81b0b3d995530736e79a38a12f9eb543cc7cc296	Mirai	elf mirai ua-wget
http://104.168.4.206/dissx86	965e3c0a85daa83a38e5841a77fad2407f42b28870ccab3f48efb7999c424127	Gafgyt	censys elf gafgyt ua-wget
http://104.168.4.206/dlr.x86	77bb5bfd97916cabf27aa1cf94b2b98d6186d5fa74a504043affd4ba68008ea6	Mirai	elf mirai ua-wget
http://104.168.4.206/dissarm4	9829a20cd8fdc4b68c10ea9393791618cbee4cd4fc4d2b36592e527e2055754a	Gafgyt	censys elf gafgyt ua-wget
http://104.168.4.206/dlr.arm	e21f243d2293493c4c13f2a26eb3de66df4842c31c2b975cb2d9e746c2ea3aac	Mirai	elf mirai ua-wget
http://104.168.4.206/adissarm5	f7d510a342d2472a5778971247dd893cc5d15ab39ba94c059a7f4c240e536f62	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dlr.arm5	8b350483d5b80efb837549355015c9279fda8278525b248dab7af1229e202454	Mirai	elf mirai ua-wget
http://104.168.4.206/dissarm6	594d0613368fa3a728bc96b756947f22adc6b03b7a0f1d82030c7f54f4c3d1bd	Gafgyt	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dlr.arm6	a1f66f3cbdecc247ba5c7fefae2642e872535ad9e7f36de71cef8210c8eef56b	Mirai	elf mirai ua-wget
http://104.168.4.206/dissarm7	8b3b5fcac17c2be4accd5c596d8b51184f39e6cf65ebcac939d02041cedf502e	Mirai	censys elf mirai ua-wget
http://104.168.4.206/dlr.arm7	e97d800f769284cea76fef951df360a5be60f820a8a5af4a77447b441ee8620e	Mirai	elf mirai ua-wget
http://104.168.4.206/disspoor	n/a	n/a	elf ua-wget
http://104.168.4.206/dlr.ppc	ced646eeb7559d7e703025a689222719f43756c8b55d4c1f007a2b2f097fefb4	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ac66dbfaded5e3ddaf653b8/reports/14669128-cd0c-44c5-87b5-5cc12f752ab7/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-07T14:20:00Z UTC

Last seen:

2026-10-07T14:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/74d946a0-66f6-4c04-93ba-39c46521cdb3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-07 16:05:26 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d63zt33qmhptrrc2ephkzbgn2tevsw5cxzyce36v4bannkly2t5a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261007-tjm3aabt4v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.22

Link:

https://yomi.yoroi.company/submissions/1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh