MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546
SHA3-384 hash:	cf127afda6e6484a03237fbbc6598ec66afe1cafa6420093f81c94583df2aee87bd5281ae37496badad3941189c7797f
SHA1 hash:	e51c3e97cbda3aa97d2187b09bca0e3baba6dc67
MD5 hash:	4368ca509123288af4f157d5b2d1a8d7
humanhash:	dakota-paris-thirteen-charlie
File name:	run.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'907 bytes
First seen:	2026-09-09 09:40:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:mr2JMqcbiBKhuZVE6EnE2EhEIOIbwZ+JUfxGhM3U:mr2JMqcbiBKhuZVVcvyeIbwhGhM3U
TLSH	T1B6515EEE11809B719B08C54EBBF03534650BE59366DEEA44ED800A1C0EC5F8C33A5B80
Magika	shell
Reporter	adliwahid

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnaarch64xnxn	a9b07a1e0dfefdca86ca624d3fd15345e0730728b0b308601ef9bcad9eb845bc	Gafgyt	gafgyt
http://172.233.43.198/bins/xnxnxnxnxnxnxnxni386xnxn	1d6cbc5c3ee170cb70f2474d5c19e6e32dc50c4ccf93cfb3ef4d218d16d4791b	Gafgyt	gafgyt
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	b5a7d7e5feb875c6084d5755386509d64684249c31bf30aab2a0663aa0b3521a	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnm68kxnxn	11de45f98073961456ac73a3fc4e6706dca3966b6a13edfbb0a67379a155a938	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	0d21996c45d6dd42c1259770c3b7ac0fc42b3122d0b8968ac7502af117ec4683	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnmipsxnxn	3993adaf81efa67f955c632fe26525ec04de23a34df76febd566c5be3344b22b	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnor1kxnxn	c4e7ac3fe351afe4dcb1146532cf821b689f09d2fe42e41001663e966bb14c16	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	n/a	n/a	n/a
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnriscv32xnxn	n/a	n/a	n/a
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnriscv64xnxn	d1ab83e8d0cb8b4f86d5827d3de0417102b147b8ee68298fe916cb1d4995c551	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnsh2xnxn	5fa112f650a9a301faa4ea162d2650c6d76f511882ca3451a9e1aa20e2d02952	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnsh4xnxn	10404dfbded574b817c106c3d32e111b779738c100de1d3de8bb0841571b2df9	Mirai	mirai
http://172.233.43.198/bins/xnxnxnxnxnxnxnxnx86_64xnxn	2803f457de61e1e1690683a9a004e8e0e70a6116c6a0132761ec3fe888d14bca	Gafgyt	gafgyt

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

text

First seen:

2026-09-08T16:19:00Z UTC

Last seen:

2026-09-10T21:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1a63fe83-89ed-4653-a839-98c9ed24b2c6

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-09-09 00:59:23 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=evufwj3fwzljwkwlqsdoftpqsbp4wjdflgbadulwaeuhds7dmvda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260909-lnle9avxbv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/25685b2765b6569b2acb8486e2cdf0905fcb2465598201d176012871cbe36546

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.