MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc
SHA3-384 hash:	bbcfd6b927c415f9e89f23b6d6ae43808cb700424db5bb883532c925faf5920535740917dbd3821c770e655d75a7d141
SHA1 hash:	10da6bad2fd663bc0db6bb3d162b4a9c851816c2
MD5 hash:	c4e00ae4e5720ca713d1892c2b02e139
humanhash:	hydrogen-summer-robert-lima
File name:	faith.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'866 bytes
First seen:	2025-06-20 08:59:01 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vGSRvMtsuqeNI7hvksUsouafVs6YrfgLSLIjxq+Kg:vdvtuqnhvJ5ouX6YrfuSLkq+N
TLSH	T19E3162DA326209762DF4ED3776EB881435D0E18E50C9AF566CDE38F8A4CDE083461AC7
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.167.221.114/mips	fd2f0b1c70e97c3c67ab54ba87a2125fb30e25a6d6050cae36a5f7f14726189c	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/mipsel	d8253b55940a3d9f0a47c58ea5e1a37c1149217c7615d4a00bafc21d31035a19	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/sh4	f43693a946b59f1d132fc620b8fc3683433c87cb046207cb18aad68b4ea091d6	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/x86_64	d24eb20bdf28154c538be3ad296756f743753886e21a86f84e41482b7a4a45f3	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm6	e89afd876b71345828df07ef82a4e6684a26cd9d8dfe5d0ee139e367de3b7330	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/i686	476e3c2d0c589ce2372f3d1bbb59bd8f3d800847b545e360eb85a290d675e254	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/powerpc	880ddb6fcd0ef13b964069147f6b97b8bbd61cbe92feaf20aa25473179c50612	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/x86	857170c9591cce002273043a6f991f58683ef3bc2be7afcca54be1dc0097b57b	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/m68k	26b8ee688812ddc7257e35c1c071a3b7d9f9487d9638be829b9998ac0894d05d	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/spc	3be913565735d606fc2d64b098763b52ed9a6ba9ca93d89f723409b0348557eb	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm	5f83df06a5fd17487df62de3f9b939088dcb1d08d06ac762df888264ec9da0e8	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm5	235733c3b02759f01d846d0333b94b3dbf2fee43d843e46f4ce062c30421b606	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/ppc4fp	n/a	n/a	elf ua-wget
http://104.167.221.114/arm7	8d8e03d31f4169577641596c31ab5ab0990ef39aa5ffea486330b230632a737a	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685522f44cf2dc14fa1b17f1linux22vpnfull_triage

Tags:

mirai agent virus overt

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dc06d899-cce0-427c-98a3-f9809adfca3f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-06-13 09:16:20 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ekbvyrb3zqesplmj5m62m454jxmo744jmle4jgg4khquieg6kpga._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/250620-kxtybacn5t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Enumerates running processes

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/22835c443bcc0927ad89eb3da673bc4dd8eff38962c9c498dc51e14410de53cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.