MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27c799ecb2a1b109251a712b32cc92fd1fc2ae09c9a15a745afc6203e96fdcf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	27c799ecb2a1b109251a712b32cc92fd1fc2ae09c9a15a745afc6203e96fdcf0
SHA3-384 hash:	0c8c5420e6485eaebb122e7e33475fa9a84788fbace3cfd9556ceb1556c5b09e422854b619a973758558f53365b0e7ed
SHA1 hash:	2837c09d52b27314fd6f6dc3dbbf17c0caec5ae7
MD5 hash:	672d39af569a750478ee2561e260b398
humanhash:	emma-white-eighteen-july
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'001 bytes
First seen:	2025-03-14 00:16:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:1M0DM0TM0XM0rM0jlwPsM0j1+XsM0/M0ioM0inUM0HM0rM0+UM0mx:1HDHTHXHrHjlwPsHj1+XsH/HLHinUHHe
TLSH	T1F34138CEA59206747D69AA23316D4A007DC9D0DBE3CA9FACF8DC74FA148DE14E040A92
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://botz.packetware.cc/gigab.arm4	0d2491233f4bc4a597f90795ed2524a2c336e91335c156eeed38fc2011584b18	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.arm4t	48d3cf463eae240eeadde8b2decc1c463b6806ca0fb6f731825aaf65b2d7efcc	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.arm5	3af699192cb5662f3f118b20e1d89faf9c2993ea9ea8c94ec45222627a477eb1	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.arm6	bf694a2c104ac68a0cb0125b75a6284940c34d87bcd53e4d2747b73f74d9f74c	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.i686	0a60dbfb0e3644d9b248d4507fa222e5fec4d44a0c8db4b23a3fd2169724090b	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.m68	08c8d9a5d01bad56d65cfde3489f50e77933bab050f39f8c9ded772cf1bef15f	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.mips	2dc579bd33972841534b74a4a45d9e270e2cda542a26e819115f6554344ac85e	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.mpsl	b07a492a30c2d349c9f0efa3f3aebdd185e7fa5892dc0fa10883b2723cb906c8	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.ppc	72cfa0843186dfb80cf31c2b4e05f2fe3ebcaa7782aee4737239d0e3c3c21184	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.spc	da479c3081c7638a1e61623bf61af46fe31f4c11910c9098a82ccc63a3dce63b	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.x86	958a93ab4d8c87fe54ee4d1fb0f7fd2333cd1c0e3b6e6ca461867748b144dc98	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.sh4	0aea978c8ef6f2a6276b64cd63a2568e3af5b97dc96f9655b6783e1d1a27bda5	Gafgyt	elf gafgyt
http://botz.packetware.cc/gigab.arm7	0aea978c8ef6f2a6276b64cd63a2568e3af5b97dc96f9655b6783e1d1a27bda5	Gafgyt	elf

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d3847f08116ce42570fda5linux22vpnfull_triage

Tags:

medusa virus

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67d375ad0a7899f357953600/reports/51457da9-f3f2-431f-9a70-55b6d3d6bbf0/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/27c799ecb2a1b109251a712b32cc92fd1fc2ae09c9a15a745afc6203e96fdcf0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27c799ecb2a1b109251a712b32cc92fd1fc2ae09c9a15a745afc6203e96fdcf0/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-03-14 00:17:33 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e7dzt3fsugyqsji2oevtftes7up4flqjzgqvu5c27rrah2lp3tya._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250314-ak6fgazjs7/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/27c799ecb2a1b109251a712b32cc92fd1fc2ae09c9a15a745afc6203e96fdcf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.