MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0
SHA3-384 hash: b6b97ae115c30be23b8b2c68f1eba56e1c36c60406580d1d05f5a176ec2c0a3b9f2a1b22d152effa55de3d48f0608675
SHA1 hash: 899e98e041f81970b840503f2bc6ce40fecf2e70
MD5 hash: 5c92230c48f25347b5f07524daf1365d
humanhash: victor-eleven-whiskey-papa
File name:tplink.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'301 bytes
First seen:2026-07-23 12:48:43 UTC
Last seen:2026-07-24 09:01:12 UTC
File type: sh
MIME type:text/plain
ssdeep 12:QvWXOp3dKU2hCUKAMzhKdqxwJjV6dfFTn/Kda0LK7dHlh2aKSnV6+nfGnMnn/K+U:QvQhBh9M0oy/O5irKluFi5limKuFF8
TLSH T1EA21F99CA996A3D32F58CDC0F0AA022AF10AA3C633734E98FC0634725CEC544B731B55
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://205.237.110.232/tvt/mips580ffce9b7b58f51cc4db2973f83300e79ee67583f59a96ebdbb4cc0c65710fb Miraielf gafgyt mirai ua-wget
http://205.237.110.232/tvt/mpsln/an/aelf mirai ua-wget
http://205.237.110.232/tvt/arm477c66e0e4a9353c29d5aa3b5d750ffabee1a65496401f4303b9b874c13e6ce5 Miraielf gafgyt mirai ua-wget
http://205.237.110.232/tvt/arm5abbeaa41254ac515bb1c2218485f5f6339cdfc83796ca31e260935e81373fd06 Miraielf mirai ua-wget
http://205.237.110.232/tvt/arm7769bd770366308fa1f6edbb235da42b5a6296ab0d3c5d672f291ae1cc566106d Miraielf mirai ua-wget
http://205.237.110.232/tvt/x865fff67b6febb6bd94d95e4ceeb6b341badf51d1cfb3930744ee05dad69434fc2 Miraielf mirai ua-wget
http://205.237.110.232/tvt/aarch64n/an/aelf mirai ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
92
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a620ddc292af52ab50923bb/reports/5f887c8b-a9c8-4271-878c-95fa9ba036c5/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-07-23T11:21:00Z UTC
Last seen:
2026-07-25T00:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c4e6757d-e169-4c2b-8118-884a1accad19
Behavior Graph:
Download SVG
%3 guuid=8206169e-1d00-0000-7e36-19db030c0000 pid=3075 /usr/bin/sudo guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082 /tmp/sample.bin guuid=8206169e-1d00-0000-7e36-19db030c0000 pid=3075->guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082 execve guuid=90e475ac-1d00-0000-7e36-19db160c0000 pid=3094 /usr/bin/rm guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=90e475ac-1d00-0000-7e36-19db160c0000 pid=3094 execve guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095 execve guuid=9d7fa3bc-1d00-0000-7e36-19db180c0000 pid=3096 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=9d7fa3bc-1d00-0000-7e36-19db180c0000 pid=3096 execve guuid=7e470cbd-1d00-0000-7e36-19db190c0000 pid=3097 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7e470cbd-1d00-0000-7e36-19db190c0000 pid=3097 clone guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100 execve guuid=68eddccc-1d00-0000-7e36-19db310c0000 pid=3121 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68eddccc-1d00-0000-7e36-19db310c0000 pid=3121 execve guuid=fa5f5acd-1d00-0000-7e36-19db320c0000 pid=3122 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=fa5f5acd-1d00-0000-7e36-19db320c0000 pid=3122 clone guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124 execve guuid=6fe855dc-1d00-0000-7e36-19db420c0000 pid=3138 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=6fe855dc-1d00-0000-7e36-19db420c0000 pid=3138 execve guuid=7573f1dd-1d00-0000-7e36-19db440c0000 pid=3140 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7573f1dd-1d00-0000-7e36-19db440c0000 pid=3140 clone guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143 execve guuid=e890dded-1d00-0000-7e36-19db540c0000 pid=3156 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=e890dded-1d00-0000-7e36-19db540c0000 pid=3156 execve guuid=e46821ee-1d00-0000-7e36-19db550c0000 pid=3157 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=e46821ee-1d00-0000-7e36-19db550c0000 pid=3157 clone guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163 execve guuid=74a00afd-1d00-0000-7e36-19db720c0000 pid=3186 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=74a00afd-1d00-0000-7e36-19db720c0000 pid=3186 execve guuid=744084fd-1d00-0000-7e36-19db740c0000 pid=3188 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=744084fd-1d00-0000-7e36-19db740c0000 pid=3188 clone guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192 execve guuid=66c95a10-1e00-0000-7e36-19db960c0000 pid=3222 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=66c95a10-1e00-0000-7e36-19db960c0000 pid=3222 execve guuid=1f23d310-1e00-0000-7e36-19db980c0000 pid=3224 /tmp/x86 guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=1f23d310-1e00-0000-7e36-19db980c0000 pid=3224 execve guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225 execve guuid=74938c1e-1e00-0000-7e36-19dba00c0000 pid=3232 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=74938c1e-1e00-0000-7e36-19dba00c0000 pid=3232 execve guuid=4891291f-1e00-0000-7e36-19dba20c0000 pid=3234 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4891291f-1e00-0000-7e36-19dba20c0000 pid=3234 clone guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236 execve guuid=fecca333-1e00-0000-7e36-19dbc90c0000 pid=3273 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=fecca333-1e00-0000-7e36-19dbc90c0000 pid=3273 execve guuid=7aca7d34-1e00-0000-7e36-19dbcd0c0000 pid=3277 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7aca7d34-1e00-0000-7e36-19dbcd0c0000 pid=3277 clone guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282 execve guuid=19138646-1e00-0000-7e36-19dbf90c0000 pid=3321 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=19138646-1e00-0000-7e36-19dbf90c0000 pid=3321 execve guuid=42a0cb46-1e00-0000-7e36-19dbfa0c0000 pid=3322 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=42a0cb46-1e00-0000-7e36-19dbfa0c0000 pid=3322 clone guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325 execve guuid=29f6fd55-1e00-0000-7e36-19db180d0000 pid=3352 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=29f6fd55-1e00-0000-7e36-19db180d0000 pid=3352 execve guuid=ec6b8956-1e00-0000-7e36-19db1a0d0000 pid=3354 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ec6b8956-1e00-0000-7e36-19db1a0d0000 pid=3354 clone guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358 execve guuid=ae4fa069-1e00-0000-7e36-19db3e0d0000 pid=3390 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ae4fa069-1e00-0000-7e36-19db3e0d0000 pid=3390 execve guuid=29678d6a-1e00-0000-7e36-19db400d0000 pid=3392 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=29678d6a-1e00-0000-7e36-19db400d0000 pid=3392 clone guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397 execve guuid=3fc2957e-1e00-0000-7e36-19db570d0000 pid=3415 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=3fc2957e-1e00-0000-7e36-19db570d0000 pid=3415 execve guuid=72e44380-1e00-0000-7e36-19db580d0000 pid=3416 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=72e44380-1e00-0000-7e36-19db580d0000 pid=3416 clone guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418 execve guuid=4c8d848f-1e00-0000-7e36-19db700d0000 pid=3440 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4c8d848f-1e00-0000-7e36-19db700d0000 pid=3440 execve guuid=4b07c68f-1e00-0000-7e36-19db710d0000 pid=3441 /tmp/x86 guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4b07c68f-1e00-0000-7e36-19db710d0000 pid=3441 execve guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442 execve guuid=49a59a9e-1e00-0000-7e36-19db8e0d0000 pid=3470 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=49a59a9e-1e00-0000-7e36-19db8e0d0000 pid=3470 execve guuid=7e83de9e-1e00-0000-7e36-19db8f0d0000 pid=3471 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7e83de9e-1e00-0000-7e36-19db8f0d0000 pid=3471 clone fa76a0f2-99b2-55a3-830c-43db003be0f4 205.237.110.232:80 guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 137B guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 137B guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 141B guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 86B guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 86B guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 90B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-07-23 12:49:37 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxz2co6acrotaq6d5b5qkilgntalvnsnto36rntxz44bwhctz6ya._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260723-p2k87acq61/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0

(this sample)

Gafgyt

elf 7ce8cf71a2111e1ebdf8f09565fc2716d84cd5be4d79fc2dc5970454d392df8b

  
URLhaus
https://urlhaus.abuse.ch/url/3887758/
  
Delivery method
Distributed via web download
  
Dropping
MD5 a957b1fae69d4d8f1266a2f86242df92
  
Dropping
SHA256 7ce8cf71a2111e1ebdf8f09565fc2716d84cd5be4d79fc2dc5970454d392df8b

Comments