MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0
SHA3-384 hash: b6b97ae115c30be23b8b2c68f1eba56e1c36c60406580d1d05f5a176ec2c0a3b9f2a1b22d152effa55de3d48f0608675
SHA1 hash: 899e98e041f81970b840503f2bc6ce40fecf2e70
MD5 hash: 5c92230c48f25347b5f07524daf1365d
humanhash: victor-eleven-whiskey-papa
File name:tplink.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'301 bytes
First seen:2026-07-23 12:48:43 UTC
Last seen:2026-07-24 01:39:59 UTC
File type: sh
MIME type:text/plain
ssdeep 12:QvWXOp3dKU2hCUKAMzhKdqxwJjV6dfFTn/Kda0LK7dHlh2aKSnV6+nfGnMnn/K+U:QvQhBh9M0oy/O5irKluFi5limKuFF8
TLSH T1EA21F99CA996A3D32F58CDC0F0AA022AF10AA3C633734E98FC0634725CEC544B731B55
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://205.237.110.232/tvt/mips7ce8cf71a2111e1ebdf8f09565fc2716d84cd5be4d79fc2dc5970454d392df8b Gafgytelf gafgyt mirai ua-wget
http://205.237.110.232/tvt/mpsl4119001a7ecd42e4eccf0694011bcccf0205064aaafec0c835c02bc943cb9053 Miraielf mirai ua-wget
http://205.237.110.232/tvt/arm84615c4dc89944b6f365616ef685ff669bf04a1ef6ccf5e2ac29058a27e94177 Miraielf mirai ua-wget
http://205.237.110.232/tvt/arm5060040eb137e800b59b39b16978531d123bc6555da3b24fb7c3687e1cacf7a07 Miraielf mirai ua-wget
http://205.237.110.232/tvt/arm7c781c043c269b8795bd66339d042d1700e9ff8707536a08d314555e82cba3651 Miraielf mirai ua-wget
http://205.237.110.232/tvt/x86a73dce30c9734e4a8e4baef959ba91d0759c05450fcd1993f4e9fc0d45142f42 Miraielf mirai ua-wget
http://205.237.110.232/tvt/aarch64631be62897d57f0740349269a3eb588ecdd2e89bf367b34421ddaaa200ec2711 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a620ddc292af52ab50923bb/reports/5f887c8b-a9c8-4271-878c-95fa9ba036c5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c4e6757d-e169-4c2b-8118-884a1accad19
Behavior Graph:
Download SVG
%3 guuid=8206169e-1d00-0000-7e36-19db030c0000 pid=3075 /usr/bin/sudo guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082 /tmp/sample.bin guuid=8206169e-1d00-0000-7e36-19db030c0000 pid=3075->guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082 execve guuid=90e475ac-1d00-0000-7e36-19db160c0000 pid=3094 /usr/bin/rm guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=90e475ac-1d00-0000-7e36-19db160c0000 pid=3094 execve guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095 execve guuid=9d7fa3bc-1d00-0000-7e36-19db180c0000 pid=3096 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=9d7fa3bc-1d00-0000-7e36-19db180c0000 pid=3096 execve guuid=7e470cbd-1d00-0000-7e36-19db190c0000 pid=3097 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7e470cbd-1d00-0000-7e36-19db190c0000 pid=3097 clone guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100 execve guuid=68eddccc-1d00-0000-7e36-19db310c0000 pid=3121 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68eddccc-1d00-0000-7e36-19db310c0000 pid=3121 execve guuid=fa5f5acd-1d00-0000-7e36-19db320c0000 pid=3122 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=fa5f5acd-1d00-0000-7e36-19db320c0000 pid=3122 clone guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124 execve guuid=6fe855dc-1d00-0000-7e36-19db420c0000 pid=3138 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=6fe855dc-1d00-0000-7e36-19db420c0000 pid=3138 execve guuid=7573f1dd-1d00-0000-7e36-19db440c0000 pid=3140 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7573f1dd-1d00-0000-7e36-19db440c0000 pid=3140 clone guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143 execve guuid=e890dded-1d00-0000-7e36-19db540c0000 pid=3156 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=e890dded-1d00-0000-7e36-19db540c0000 pid=3156 execve guuid=e46821ee-1d00-0000-7e36-19db550c0000 pid=3157 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=e46821ee-1d00-0000-7e36-19db550c0000 pid=3157 clone guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163 execve guuid=74a00afd-1d00-0000-7e36-19db720c0000 pid=3186 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=74a00afd-1d00-0000-7e36-19db720c0000 pid=3186 execve guuid=744084fd-1d00-0000-7e36-19db740c0000 pid=3188 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=744084fd-1d00-0000-7e36-19db740c0000 pid=3188 clone guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192 execve guuid=66c95a10-1e00-0000-7e36-19db960c0000 pid=3222 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=66c95a10-1e00-0000-7e36-19db960c0000 pid=3222 execve guuid=1f23d310-1e00-0000-7e36-19db980c0000 pid=3224 /tmp/x86 guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=1f23d310-1e00-0000-7e36-19db980c0000 pid=3224 execve guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225 /usr/bin/wget net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225 execve guuid=74938c1e-1e00-0000-7e36-19dba00c0000 pid=3232 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=74938c1e-1e00-0000-7e36-19dba00c0000 pid=3232 execve guuid=4891291f-1e00-0000-7e36-19dba20c0000 pid=3234 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4891291f-1e00-0000-7e36-19dba20c0000 pid=3234 clone guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236 execve guuid=fecca333-1e00-0000-7e36-19dbc90c0000 pid=3273 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=fecca333-1e00-0000-7e36-19dbc90c0000 pid=3273 execve guuid=7aca7d34-1e00-0000-7e36-19dbcd0c0000 pid=3277 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7aca7d34-1e00-0000-7e36-19dbcd0c0000 pid=3277 clone guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282 execve guuid=19138646-1e00-0000-7e36-19dbf90c0000 pid=3321 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=19138646-1e00-0000-7e36-19dbf90c0000 pid=3321 execve guuid=42a0cb46-1e00-0000-7e36-19dbfa0c0000 pid=3322 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=42a0cb46-1e00-0000-7e36-19dbfa0c0000 pid=3322 clone guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325 execve guuid=29f6fd55-1e00-0000-7e36-19db180d0000 pid=3352 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=29f6fd55-1e00-0000-7e36-19db180d0000 pid=3352 execve guuid=ec6b8956-1e00-0000-7e36-19db1a0d0000 pid=3354 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ec6b8956-1e00-0000-7e36-19db1a0d0000 pid=3354 clone guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358 execve guuid=ae4fa069-1e00-0000-7e36-19db3e0d0000 pid=3390 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=ae4fa069-1e00-0000-7e36-19db3e0d0000 pid=3390 execve guuid=29678d6a-1e00-0000-7e36-19db400d0000 pid=3392 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=29678d6a-1e00-0000-7e36-19db400d0000 pid=3392 clone guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397 execve guuid=3fc2957e-1e00-0000-7e36-19db570d0000 pid=3415 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=3fc2957e-1e00-0000-7e36-19db570d0000 pid=3415 execve guuid=72e44380-1e00-0000-7e36-19db580d0000 pid=3416 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=72e44380-1e00-0000-7e36-19db580d0000 pid=3416 clone guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418 execve guuid=4c8d848f-1e00-0000-7e36-19db700d0000 pid=3440 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4c8d848f-1e00-0000-7e36-19db700d0000 pid=3440 execve guuid=4b07c68f-1e00-0000-7e36-19db710d0000 pid=3441 /tmp/x86 guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=4b07c68f-1e00-0000-7e36-19db710d0000 pid=3441 execve guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442 /usr/bin/curl net send-data write-file guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442 execve guuid=49a59a9e-1e00-0000-7e36-19db8e0d0000 pid=3470 /usr/bin/chmod guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=49a59a9e-1e00-0000-7e36-19db8e0d0000 pid=3470 execve guuid=7e83de9e-1e00-0000-7e36-19db8f0d0000 pid=3471 /usr/bin/dash guuid=b8db6fa0-1d00-0000-7e36-19db0a0c0000 pid=3082->guuid=7e83de9e-1e00-0000-7e36-19db8f0d0000 pid=3471 clone fa76a0f2-99b2-55a3-830c-43db003be0f4 205.237.110.232:80 guuid=ac4920ad-1d00-0000-7e36-19db170c0000 pid=3095->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=d69ba5bd-1d00-0000-7e36-19db1c0c0000 pid=3100->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=b1073bce-1d00-0000-7e36-19db340c0000 pid=3124->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 137B guuid=139ba2e0-1d00-0000-7e36-19db470c0000 pid=3143->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=3d0c4def-1d00-0000-7e36-19db5b0c0000 pid=3163->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 138B guuid=68e322fe-1d00-0000-7e36-19db780c0000 pid=3192->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 137B guuid=4a59f210-1e00-0000-7e36-19db990c0000 pid=3225->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 141B guuid=68eb7f20-1e00-0000-7e36-19dba40c0000 pid=3236->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=2c334535-1e00-0000-7e36-19dbd20c0000 pid=3282->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=711b6e47-1e00-0000-7e36-19dbfd0c0000 pid=3325->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 86B guuid=a1109557-1e00-0000-7e36-19db1e0d0000 pid=3358->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=a646386d-1e00-0000-7e36-19db450d0000 pid=3397->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 87B guuid=53bb8d81-1e00-0000-7e36-19db5a0d0000 pid=3418->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 86B guuid=af19e78f-1e00-0000-7e36-19db720d0000 pid=3442->fa76a0f2-99b2-55a3-830c-43db003be0f4 send: 90B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-07-23 12:49:37 UTC
File Type:
Text (Shell)
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxz2co6acrotaq6d5b5qkilgntalvnsnto36rntxz44bwhctz6ya._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260723-p2k87acq61/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 3df3a13bc0145d3043c3e87b0521666cc0bab64d9bb7e8b677cf381b1c53cfb0

(this sample)

Gafgyt

elf 7ce8cf71a2111e1ebdf8f09565fc2716d84cd5be4d79fc2dc5970454d392df8b

  
URLhaus
https://urlhaus.abuse.ch/url/3887758/
  
Delivery method
Distributed via web download
  
Dropping
MD5 a957b1fae69d4d8f1266a2f86242df92
  
Dropping
SHA256 7ce8cf71a2111e1ebdf8f09565fc2716d84cd5be4d79fc2dc5970454d392df8b

Comments