MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a3f1fe57a508b7cf3dfde7f35725744529b7c29a38e1128682a11c04c69aad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	27a3f1fe57a508b7cf3dfde7f35725744529b7c29a38e1128682a11c04c69aad
SHA3-384 hash:	fcae83272e7bf8adf365324d0b8a8031e9df4023519ae16e83521314970614b89ed1f97223dd2cb7b5bb8145c7f07ee9
SHA1 hash:	108881c5fe5664f8d8966ac85c1d75f8fd797643
MD5 hash:	df6a79f7147320373a182c0b701f36af
humanhash:	single-butter-fix-four
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'546 bytes
First seen:	2025-02-07 22:51:13 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:BXOaxXPGwXVwFxUquLBXFsSX2wGGKmX4q/Xy4CZsiCvXp6OX5pJenJ+XyG1HXdpq:BXjX3XBlX7XzXDXy7qtvXPXPXHXdzktj
TLSH	T123316DDF83D05500C5F9BE6EBE27FD80124CA1D2F8566FD9ACD82C39764DE4A7011A42
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://bins.freesite.host/bins/jackmymips	c5a252c6c7613e4a50ced47a624ed4ce3787b115518114a0555b31d9a63ea4e5	Gafgyt	elf gafgyt mirai
http://bins.freesite.host/bins/jackmymipsel	b56c148fa30ed9a70689592f126ccee72d0d557fc2f1837e29acbc23f4834ce2	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmysh4	942b941595845f743dc56f8500d583e5279d947d1da1fce85ba6da2d68184b32	Gafgyt	elf gafgyt mirai
http://bins.freesite.host/bins/jackmyx86	6b64c98adacb31fa5f66578ac0160c9298cdc15ea9426e503f5f57663350abb9	Gafgyt	elf gafgyt mirai
http://bins.freesite.host/bins/jackmyarmv6	5de8cc1d8e0a6111d9df026906abf69b394a453c9a9e1928713532ccad07347a	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmyi686	864efd17093cf1fbe758e71b904737032162e1d2072fea0ac8e9a1ec3c9dd7aa	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmypowerpc	6227ee3d6de82a192485c5759e577a45e47d4680b4e1e0b3b103c9d0e9a2523a	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmyi586	d8ddcd876e8428facde0a83d30ca573ad821d32de42006a2262b500f877ea807	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmym86k	2733ecac081356843673c91d29e0fb6e97da3d0d5853484e39466f1c2610618c	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmysparc	40c8fe7b6cce8e6a4f5bbeabaf4610eabf71dbd016a154674592a1293a190c5e	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmyarmv4	a9aca166b0102d703eaf6272ffac6e4d94f5bddd39db43d6115713152b257d54	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmyarmv5	8b39b83968fd19714c2f895c6eaed9c7a9b90ab538657653df6f3f65af0445ba	Gafgyt	elf gafgyt
http://bins.freesite.host/bins/jackmypowerpc440	8b39b83968fd19714c2f895c6eaed9c7a9b90ab538657653df6f3f65af0445ba	Gafgyt	elf

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a68f0cd010e522d1b7e1a4linux22vpnfull_triage

Tags:

mirai virus

Result

Verdict:

MALICIOUS

Score:

92%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/27a3f1fe57a508b7cf3dfde7f35725744529b7c29a38e1128682a11c04c69aad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27a3f1fe57a508b7cf3dfde7f35725744529b7c29a38e1128682a11c04c69aad/

Threat name:

Win32.Trojan.Gafgyt

Status:

Malicious

First seen:

2025-02-07 21:40:13 UTC

File Type:

Text (Shell)

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e6r7d7sxuuelptz57xt7gvzforcstn6cti4oceugqkqrybggtkwq._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250207-2tf1qatkaj/

Behaviour

System Network Configuration Discovery

File and Directory Permissions Modification

Executes dropped EXE

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

Malware Config

C2 Extraction:

165.154.224.116:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

BASHLITE

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/27a3f1fe57a508b7cf3dfde7f35725744529b7c29a38e1128682a11c04c69aad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.