MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068
SHA3-384 hash:	f5535a7a8e7c68a9a1f707e6fd405f893088769b9325506fe98b5dd185287a1955ad2af60185ab338bb346a98b7e5407
SHA1 hash:	29153eb9742d9c073c673a7a4ebd375681b2428b
MD5 hash:	7f850fe20a2103edc9556e1c851d51d4
humanhash:	illinois-avocado-robert-blossom
File name:	36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	519 bytes
First seen:	2025-09-29 08:02:04 UTC
Last seen:	2025-11-09 11:30:16 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:UEmMSxRQanyGdVwanyKA3NgGkkRQanyGESanyn:U8Hany0wanylNITanyeanyn
TLSH	T1C0F089AA35553C30E424783B295745DC291F808BF967CF86BD7C9579C89FC24B8A0D44
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.94.209.216/emips	fba5f81d83f00d094c55233e6364d14adc07de15a4b48c52c505cf324487d30e	Gafgyt	elf gafgyt
ftp://8.94.209.216:21/emips	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/68da3d116c140e5b35ff2e14/reports/4c2dca50-1350-4ca9-92e4-5b4da309aca3/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-14T10:16:00Z UTC

Last seen:

2025-09-14T10:16:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e98696b1-0636-4950-9acc-47edbcebf73d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068

Threat name:

Script-Shell.Browser.Tsunami

Status:

Malicious

First seen:

2025-09-14 12:52:18 UTC

File Type:

Text (Shell)

AV detection:

6 of 37 (16.22%)

Threat level:

4/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g27jmci6vf7325qgllvopq6dfdpogvkyrua3tpzhglv67nak2bua._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250929-jxac8sytdt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/36be96091ea97fbd76065aeae7c3c328dee355588d01b9bf2732ebefb40ad068

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.