MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d
SHA3-384 hash:	c82cf3881394b994c2be771397f6e2fd3f3867cfe64ff6c6e8537414669e9872c477956af6cfe3eff543a6e9678b11a6
SHA1 hash:	912ecf5bed2d49b82f9f8c6d8679680a7e6a1897
MD5 hash:	2f6c603f3b8443f8acf4d8381ca18b84
humanhash:	golf-twelve-kentucky-floor
File name:	tplink
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	7'028 bytes
First seen:	2025-05-15 02:21:56 UTC
Last seen:	2025-05-16 02:30:21 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:NNJeC9F99P5Fhy3QaNpeKNlF93jTNTryHL27ywt4ouJ:4+c3QDA3kHLYywt4ouJ
TLSH	T1CEE134CC3D914BBA0E1ADFE9E621C85AA44ED4C364908F192ABE20F8E9FDF047D14557
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.142.53.233/mips	63e5d4c2ac320aa49bfc1c23e1a253c00ec5e51b4b64f0fb304c34f4d0a6fa56	Gafgyt	ddos elf gafgyt mirai
http://185.142.53.233/mpsl	1f20bd51306a7cd754a0d6864311ca2a4fc8def258607ba35285216eb39e6891	Gafgyt	ddos elf gafgyt mirai
http://185.142.53.233/x86	05e5afb5cf3997973ad7701749efddcc5876dcf7069d398c95c3e8dda1b2d088	Mirai	ddos elf mirai
http://185.142.53.233/i686	18649e80c64bc1b3c27f82fb5b86424ac7d8b2c910dc10d888cdc1d4bd4db2bc	Mirai	ddos elf mirai
http://185.142.53.233/sh4	b2aae96dfe77848425790b7370da4c15fa7de04d3cb2c6469470c751bce0eb09	Gafgyt	gafgyt mirai ua-wget
http://185.142.53.233/ppc	17277a6d4918a77790c1492d4595367a53249ad3e646589083488bba619b6fd3	Mirai	mirai ua-wget
http://185.142.53.233/arc	n/a	n/a	mirai ua-wget
http://185.142.53.233/arm	4e630d71a3ebf5faede6525d46ec1ce4880c2276b941e71f03fea47189efcbe4	Mirai	ddos elf mirai
http://185.142.53.233/arm5	71922b4599572f865e6446137409eddcca93ef567eeded9c2684c5adf9d33c72	Mirai	ddos elf mirai
http://185.142.53.233/arm6	b1d10651ccda9afdfb1876f967df8b4f2971283e928dfcbc6f867abc58581dcb	Mirai	ddos elf mirai
http://185.142.53.233/arm7	b530d6edb5659f75331fac721a888aaae428a06d6b3f658b1b0c9d23c4b75ba0	Mirai	mirai ua-wget
ftp://5.142.53.233:8021/mips	n/a	n/a	n/a
ftp://5.142.53.233:8021/mpsl	n/a	n/a	n/a
ftp://5.142.53.233:8021/x86	n/a	n/a	n/a
ftp://5.142.53.233:8021/i686	n/a	n/a	n/a
ftp://5.142.53.233:8021/sh4	n/a	n/a	n/a
ftp://5.142.53.233:8021/ppc	n/a	n/a	n/a
ftp://5.142.53.233:8021/arc	n/a	n/a	n/a
ftp://5.142.53.233:8021/arm	n/a	n/a	n/a
ftp://5.142.53.233:8021/arm5	n/a	n/a	n/a
ftp://5.142.53.233:8021/arm6	n/a	n/a	n/a
ftp://5.142.53.233:8021/arm7	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68257c4f4a59e5a2ce04b4aflinux22vpnfull_triage

Tags:

trojan agent hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/68254fcd15ed82cd53d76480/reports/93e9beed-1d09-45a1-bb76-8e6c4f8d14a5/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-05-15 05:26:47 UTC

File Type:

Text (Shell)

AV detection:

12 of 37 (32.43%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hgz2gyggfwvvzfhos52mytkqvlb5bw4kxuzj6irpouyszmwboagq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250515-f472asgl7z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/39b3a360c62dab5c94ee9774cc4d50aac3d0db8abd329f222f75312cb2c1700d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.