MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d
SHA3-384 hash: 516c7d13da5b8876bf23329d03a46403152d9dc84e6a1711b2621962046552b656b64876809226a5b6f3c67712aa8d10
SHA1 hash: 492bf12d841f6a75d703829efbdc83a91174bd3d
MD5 hash: 423e8749313efb5142b018ebc091cbd7
humanhash: berlin-eleven-twenty-mirror
File name:Sakura.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:3'762 bytes
First seen:2026-08-11 09:46:39 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:1Od8RpttQdMogPb9puTuE2YwbrJ5vYwb7aIkIENq89QMrUU4EQrUkJD/:7TQdymxsf9/
TLSH T1BC71B2CB21A20AF36DA0ED3332B58484F8D4A48B94C69F0A6DED3CD548EED5CB441783
Magika csv
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://23.251.34.31/m-i.p-s.Sakura408026ea525490fd64312ace9e65d433ce6f0f43f3ae833834261aade507c2d6 Gafgytcensys elf ua-wget
http://23.251.34.31/m-p.s-l.Sakura07d24f98d34ebcd0e8fe40ea9218805c94dd500e4ed3c3a0cebf79692aa53802 Gafgytcensys elf ua-wget
http://23.251.34.31/s-h.4-.Sakura68feece51b734c46cd81c082c80515282a66da2872d3fe9c83c62199d9aba7a9 Gafgytcensys elf ua-wget
http://23.251.34.31/x-8.6-.Sakura196772edc837099074968add1bdf7bce8a94feb0df69721ca6327e9e877e3965 Gafgytcensys elf gafgyt ua-wget
http://23.251.34.31/a-r.m-6.Sakura9680789e5b74e294572da7ae8030d1632a60010b3c9fcab7a4eff824725f6435 Gafgytcensys elf ua-wget
http://23.251.34.31/x-3.2-.Sakura61958a485732d3fb76ef286246047687239f374e873281dfdeddb1538a889958 Gafgytcensys elf gafgyt ua-wget
http://23.251.34.31/a-r.m-7.Sakurab81a71fa2b2a01e87b9c21d293665235cf359e86676acb66dbe2fe4f5a931610 Gafgytcensys elf gafgyt ua-wget
http://23.251.34.31/p-p.c-.Sakura02d70eb6accd3567b63b1841e22c9646dabca3f01ab8eb021a2e666e4e0fa233 Gafgytcensys elf ua-wget
http://23.251.34.31/i-5.8-6.Sakura4fc97f256de9e479b9befc4de3afa6a9236672605f3215e37869ae173fb6b281 Gafgytcensys elf ua-wget
http://23.251.34.31/m-6.8-k.Sakurab8c508760c9a35304b17ac4156b93ee76b6b57bb05e2426c5f9912b65ffea0bd Gafgytcensys elf ua-wget
http://23.251.34.31/a-r.m-4.Sakura02d70eb6accd3567b63b1841e22c9646dabca3f01ab8eb021a2e666e4e0fa233 Gafgytcensys elf ua-wget
http://23.251.34.31/a-r.m-5.Sakura7ff2375f3300ce58ae4f6058d98481b3004489b1d781403c2fe9b58d63283c6c Gafgytcensys elf ua-wget
http://220.158.234.220/arm061c72a8e7fc2957d388b5f0e5458064e40b1e82d1ff0ccb67a09959d4bcb5a9 Miraielf mirai ua-wget
http://220.158.234.220/arm53c5228311e4366042fc1fef9f9e960fa94b30267052cf7818d039ce4d256c15e Miraielf mirai ua-wget
http://220.158.234.220/arm6e7f3b31f2d6074f1f804fb3f6e51f172a60c75834d68cbd55e495316f41455a7 Miraielf mirai ua-wget
http://220.158.234.220/arm730021ebe609908ad9b5a42a38b9be1e83225a86f2b7c15b77dc7ec91e016dff2 Miraielf mirai ua-wget
http://220.158.234.220/m68kded67d13db4b33119436c67e94142e5e903ac5c7dbad6e98274914dc0f8d6182 Miraielf mirai ua-wget
http://220.158.234.220/mipsb76e9c4be46dd696a998d2eef5a0a5228c713d7b659358ef08cc647ab98845db Miraielf mirai ua-wget
http://220.158.234.220/mpslaafd12aeaa84605735be12b0fd162674e7715011d7fe1db3f1ceb492b31c6d12 Miraielf mirai ua-wget
http://220.158.234.220/ppc717956c13e9a4ae5e18a66dad4b4aba9e20824382663344a3352e1fd1f9c9663 Miraielf mirai ua-wget
http://220.158.234.220/sh49c3d18dac0e9364bbb11423f3f1c1f58535d1ede52751b078a1c5e73b653c4bb Miraielf mirai ua-wget
http://220.158.234.220/spcfdefb11a39dd231810addbb1e5d210bf7c1fc6ea52466614abbc2e15c7b3fdae Miraielf mirai ua-wget
http://220.158.234.220/x861fe41e8a4f1dfe024f2b184c5108f38af1199fbce4875fc979de4451681af566 Miraielf mirai ua-wget
http://220.158.234.220/x86_640dde7f3ddfe8924aa019bc2f8204aa6205aa8c04fec5b7c3284e6424b0aab204 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader evasive mirai
Link:
https://www.filescan.io/uploads/6a7aefaebe5deddcffd25072/reports/72725698-5121-4b6c-9d68-331c528c9a49/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-08-11T07:38:00Z UTC
Last seen:
2026-08-11T18:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9f9046d6-a6e2-4489-974c-41d83515bd06
Behavior Graph:
Download SVG
%3 guuid=ddb0ff1b-1800-0000-a249-ec579a070000 pid=1946 /usr/bin/sudo guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952 /tmp/sample.bin guuid=ddb0ff1b-1800-0000-a249-ec579a070000 pid=1946->guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952 execve guuid=654dc61e-1800-0000-a249-ec57a1070000 pid=1953 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=654dc61e-1800-0000-a249-ec57a1070000 pid=1953 execve guuid=2048f050-1800-0000-a249-ec5705080000 pid=2053 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=2048f050-1800-0000-a249-ec5705080000 pid=2053 execve guuid=15313751-1800-0000-a249-ec5707080000 pid=2055 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=15313751-1800-0000-a249-ec5707080000 pid=2055 clone guuid=677b4251-1800-0000-a249-ec5708080000 pid=2056 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=677b4251-1800-0000-a249-ec5708080000 pid=2056 execve guuid=316b8151-1800-0000-a249-ec570a080000 pid=2058 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=316b8151-1800-0000-a249-ec570a080000 pid=2058 execve guuid=cde5c07f-1800-0000-a249-ec5779080000 pid=2169 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=cde5c07f-1800-0000-a249-ec5779080000 pid=2169 execve guuid=b4671680-1800-0000-a249-ec577b080000 pid=2171 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b4671680-1800-0000-a249-ec577b080000 pid=2171 clone guuid=06fc2580-1800-0000-a249-ec577c080000 pid=2172 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=06fc2580-1800-0000-a249-ec577c080000 pid=2172 execve guuid=98267c80-1800-0000-a249-ec577e080000 pid=2174 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=98267c80-1800-0000-a249-ec577e080000 pid=2174 execve guuid=076398ae-1800-0000-a249-ec57d2080000 pid=2258 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=076398ae-1800-0000-a249-ec57d2080000 pid=2258 execve guuid=24cddfae-1800-0000-a249-ec57d3080000 pid=2259 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=24cddfae-1800-0000-a249-ec57d3080000 pid=2259 clone guuid=679604af-1800-0000-a249-ec57d4080000 pid=2260 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=679604af-1800-0000-a249-ec57d4080000 pid=2260 execve guuid=42ff50af-1800-0000-a249-ec57d5080000 pid=2261 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=42ff50af-1800-0000-a249-ec57d5080000 pid=2261 execve guuid=69608ddc-1800-0000-a249-ec572e090000 pid=2350 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=69608ddc-1800-0000-a249-ec572e090000 pid=2350 execve guuid=4896eadc-1800-0000-a249-ec5730090000 pid=2352 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=4896eadc-1800-0000-a249-ec5730090000 pid=2352 clone guuid=1ccdf8dc-1800-0000-a249-ec5731090000 pid=2353 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=1ccdf8dc-1800-0000-a249-ec5731090000 pid=2353 execve guuid=61ab45dd-1800-0000-a249-ec5733090000 pid=2355 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=61ab45dd-1800-0000-a249-ec5733090000 pid=2355 execve guuid=bce3440b-1900-0000-a249-ec578b090000 pid=2443 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=bce3440b-1900-0000-a249-ec578b090000 pid=2443 execve guuid=6ef2a30b-1900-0000-a249-ec578c090000 pid=2444 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=6ef2a30b-1900-0000-a249-ec578c090000 pid=2444 clone guuid=7911c20b-1900-0000-a249-ec578e090000 pid=2446 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=7911c20b-1900-0000-a249-ec578e090000 pid=2446 execve guuid=ea641a0c-1900-0000-a249-ec5790090000 pid=2448 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=ea641a0c-1900-0000-a249-ec5790090000 pid=2448 execve guuid=e8df4b39-1900-0000-a249-ec57ff090000 pid=2559 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=e8df4b39-1900-0000-a249-ec57ff090000 pid=2559 execve guuid=eca2b639-1900-0000-a249-ec57000a0000 pid=2560 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=eca2b639-1900-0000-a249-ec57000a0000 pid=2560 clone guuid=c2adc439-1900-0000-a249-ec57020a0000 pid=2562 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=c2adc439-1900-0000-a249-ec57020a0000 pid=2562 execve guuid=d408143a-1900-0000-a249-ec57030a0000 pid=2563 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d408143a-1900-0000-a249-ec57030a0000 pid=2563 execve guuid=1738bf68-1900-0000-a249-ec576a0a0000 pid=2666 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=1738bf68-1900-0000-a249-ec576a0a0000 pid=2666 execve guuid=a1997869-1900-0000-a249-ec576b0a0000 pid=2667 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=a1997869-1900-0000-a249-ec576b0a0000 pid=2667 clone guuid=e53c9469-1900-0000-a249-ec576c0a0000 pid=2668 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=e53c9469-1900-0000-a249-ec576c0a0000 pid=2668 execve guuid=1cf63c6a-1900-0000-a249-ec576d0a0000 pid=2669 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=1cf63c6a-1900-0000-a249-ec576d0a0000 pid=2669 execve guuid=d1e6c398-1900-0000-a249-ec57b60a0000 pid=2742 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d1e6c398-1900-0000-a249-ec57b60a0000 pid=2742 execve guuid=ad852199-1900-0000-a249-ec57b80a0000 pid=2744 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=ad852199-1900-0000-a249-ec57b80a0000 pid=2744 clone guuid=84dd3b99-1900-0000-a249-ec57b90a0000 pid=2745 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=84dd3b99-1900-0000-a249-ec57b90a0000 pid=2745 execve guuid=83828599-1900-0000-a249-ec57ba0a0000 pid=2746 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=83828599-1900-0000-a249-ec57ba0a0000 pid=2746 execve guuid=85198bc7-1900-0000-a249-ec57150b0000 pid=2837 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=85198bc7-1900-0000-a249-ec57150b0000 pid=2837 execve guuid=1fc2dac7-1900-0000-a249-ec57170b0000 pid=2839 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=1fc2dac7-1900-0000-a249-ec57170b0000 pid=2839 clone guuid=9d86e5c7-1900-0000-a249-ec57190b0000 pid=2841 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=9d86e5c7-1900-0000-a249-ec57190b0000 pid=2841 execve guuid=4cbb2dc8-1900-0000-a249-ec571a0b0000 pid=2842 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=4cbb2dc8-1900-0000-a249-ec571a0b0000 pid=2842 execve guuid=15cbc4f5-1900-0000-a249-ec57700b0000 pid=2928 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=15cbc4f5-1900-0000-a249-ec57700b0000 pid=2928 execve guuid=d9f911f6-1900-0000-a249-ec57720b0000 pid=2930 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d9f911f6-1900-0000-a249-ec57720b0000 pid=2930 clone guuid=509334f6-1900-0000-a249-ec57730b0000 pid=2931 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=509334f6-1900-0000-a249-ec57730b0000 pid=2931 execve guuid=a00ab5f6-1900-0000-a249-ec57760b0000 pid=2934 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=a00ab5f6-1900-0000-a249-ec57760b0000 pid=2934 execve guuid=3e3e7c25-1a00-0000-a249-ec57e40b0000 pid=3044 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=3e3e7c25-1a00-0000-a249-ec57e40b0000 pid=3044 execve guuid=d868dd25-1a00-0000-a249-ec57e60b0000 pid=3046 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d868dd25-1a00-0000-a249-ec57e60b0000 pid=3046 clone guuid=b955ec25-1a00-0000-a249-ec57e70b0000 pid=3047 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b955ec25-1a00-0000-a249-ec57e70b0000 pid=3047 execve guuid=a61d4226-1a00-0000-a249-ec57e90b0000 pid=3049 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=a61d4226-1a00-0000-a249-ec57e90b0000 pid=3049 execve guuid=4ce23555-1a00-0000-a249-ec57250c0000 pid=3109 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=4ce23555-1a00-0000-a249-ec57250c0000 pid=3109 execve guuid=c5950e56-1a00-0000-a249-ec57280c0000 pid=3112 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=c5950e56-1a00-0000-a249-ec57280c0000 pid=3112 clone guuid=d1a83956-1a00-0000-a249-ec57290c0000 pid=3113 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d1a83956-1a00-0000-a249-ec57290c0000 pid=3113 execve guuid=b206bc56-1a00-0000-a249-ec572b0c0000 pid=3115 /usr/bin/wget net send-data write-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b206bc56-1a00-0000-a249-ec572b0c0000 pid=3115 execve guuid=cfefef85-1a00-0000-a249-ec57550c0000 pid=3157 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=cfefef85-1a00-0000-a249-ec57550c0000 pid=3157 execve guuid=51065d86-1a00-0000-a249-ec57570c0000 pid=3159 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=51065d86-1a00-0000-a249-ec57570c0000 pid=3159 clone guuid=c98e6e86-1a00-0000-a249-ec57580c0000 pid=3160 /usr/bin/rm delete-file guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=c98e6e86-1a00-0000-a249-ec57580c0000 pid=3160 execve guuid=dda6e886-1a00-0000-a249-ec57590c0000 pid=3161 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=dda6e886-1a00-0000-a249-ec57590c0000 pid=3161 execve guuid=f47e5a95-1a00-0000-a249-ec57620c0000 pid=3170 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=f47e5a95-1a00-0000-a249-ec57620c0000 pid=3170 execve guuid=e9cac895-1a00-0000-a249-ec57640c0000 pid=3172 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=e9cac895-1a00-0000-a249-ec57640c0000 pid=3172 clone guuid=8a23e195-1a00-0000-a249-ec57650c0000 pid=3173 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=8a23e195-1a00-0000-a249-ec57650c0000 pid=3173 execve guuid=b4594096-1a00-0000-a249-ec57670c0000 pid=3175 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b4594096-1a00-0000-a249-ec57670c0000 pid=3175 execve guuid=32cc4ea3-1a00-0000-a249-ec57780c0000 pid=3192 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=32cc4ea3-1a00-0000-a249-ec57780c0000 pid=3192 execve guuid=9a93bfa3-1a00-0000-a249-ec577a0c0000 pid=3194 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=9a93bfa3-1a00-0000-a249-ec577a0c0000 pid=3194 clone guuid=5964cca3-1a00-0000-a249-ec577b0c0000 pid=3195 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=5964cca3-1a00-0000-a249-ec577b0c0000 pid=3195 execve guuid=16c01ba4-1a00-0000-a249-ec577d0c0000 pid=3197 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=16c01ba4-1a00-0000-a249-ec577d0c0000 pid=3197 execve guuid=d7836fb3-1a00-0000-a249-ec57900c0000 pid=3216 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d7836fb3-1a00-0000-a249-ec57900c0000 pid=3216 execve guuid=31cbceb3-1a00-0000-a249-ec57920c0000 pid=3218 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=31cbceb3-1a00-0000-a249-ec57920c0000 pid=3218 clone guuid=b8af06b4-1a00-0000-a249-ec57930c0000 pid=3219 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b8af06b4-1a00-0000-a249-ec57930c0000 pid=3219 execve guuid=bca65eb4-1a00-0000-a249-ec57940c0000 pid=3220 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=bca65eb4-1a00-0000-a249-ec57940c0000 pid=3220 execve guuid=9b5bb8c1-1a00-0000-a249-ec57b00c0000 pid=3248 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=9b5bb8c1-1a00-0000-a249-ec57b00c0000 pid=3248 execve guuid=e14df7c1-1a00-0000-a249-ec57b10c0000 pid=3249 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=e14df7c1-1a00-0000-a249-ec57b10c0000 pid=3249 clone guuid=f5dc10c2-1a00-0000-a249-ec57b20c0000 pid=3250 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=f5dc10c2-1a00-0000-a249-ec57b20c0000 pid=3250 execve guuid=489873c2-1a00-0000-a249-ec57b40c0000 pid=3252 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=489873c2-1a00-0000-a249-ec57b40c0000 pid=3252 execve guuid=d0871bcf-1a00-0000-a249-ec57cd0c0000 pid=3277 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d0871bcf-1a00-0000-a249-ec57cd0c0000 pid=3277 execve guuid=31fe89cf-1a00-0000-a249-ec57ce0c0000 pid=3278 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=31fe89cf-1a00-0000-a249-ec57ce0c0000 pid=3278 clone guuid=3844a6cf-1a00-0000-a249-ec57cf0c0000 pid=3279 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=3844a6cf-1a00-0000-a249-ec57cf0c0000 pid=3279 execve guuid=548968d0-1a00-0000-a249-ec57d00c0000 pid=3280 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=548968d0-1a00-0000-a249-ec57d00c0000 pid=3280 execve guuid=9f710be0-1a00-0000-a249-ec57de0c0000 pid=3294 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=9f710be0-1a00-0000-a249-ec57de0c0000 pid=3294 execve guuid=33027ae0-1a00-0000-a249-ec57e00c0000 pid=3296 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=33027ae0-1a00-0000-a249-ec57e00c0000 pid=3296 clone guuid=08608fe0-1a00-0000-a249-ec57e20c0000 pid=3298 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=08608fe0-1a00-0000-a249-ec57e20c0000 pid=3298 execve guuid=b507d5e0-1a00-0000-a249-ec57e30c0000 pid=3299 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=b507d5e0-1a00-0000-a249-ec57e30c0000 pid=3299 execve guuid=8d6ee4ee-1a00-0000-a249-ec57000d0000 pid=3328 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=8d6ee4ee-1a00-0000-a249-ec57000d0000 pid=3328 execve guuid=be6025ef-1a00-0000-a249-ec57020d0000 pid=3330 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=be6025ef-1a00-0000-a249-ec57020d0000 pid=3330 clone guuid=a3652bef-1a00-0000-a249-ec57030d0000 pid=3331 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=a3652bef-1a00-0000-a249-ec57030d0000 pid=3331 execve guuid=ea2162ef-1a00-0000-a249-ec57050d0000 pid=3333 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=ea2162ef-1a00-0000-a249-ec57050d0000 pid=3333 execve guuid=93e4f7fb-1a00-0000-a249-ec57070d0000 pid=3335 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=93e4f7fb-1a00-0000-a249-ec57070d0000 pid=3335 execve guuid=70774ffc-1a00-0000-a249-ec57090d0000 pid=3337 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=70774ffc-1a00-0000-a249-ec57090d0000 pid=3337 clone guuid=5f4c5ffc-1a00-0000-a249-ec570a0d0000 pid=3338 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=5f4c5ffc-1a00-0000-a249-ec570a0d0000 pid=3338 execve guuid=fb8b9bfc-1a00-0000-a249-ec570b0d0000 pid=3339 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=fb8b9bfc-1a00-0000-a249-ec570b0d0000 pid=3339 execve guuid=f71f0e0a-1b00-0000-a249-ec57260d0000 pid=3366 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=f71f0e0a-1b00-0000-a249-ec57260d0000 pid=3366 execve guuid=ce4d740a-1b00-0000-a249-ec57270d0000 pid=3367 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=ce4d740a-1b00-0000-a249-ec57270d0000 pid=3367 clone guuid=45a7880a-1b00-0000-a249-ec57290d0000 pid=3369 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=45a7880a-1b00-0000-a249-ec57290d0000 pid=3369 execve guuid=6e02e90a-1b00-0000-a249-ec572a0d0000 pid=3370 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=6e02e90a-1b00-0000-a249-ec572a0d0000 pid=3370 execve guuid=d5f30c18-1b00-0000-a249-ec574a0d0000 pid=3402 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d5f30c18-1b00-0000-a249-ec574a0d0000 pid=3402 execve guuid=91ed7718-1b00-0000-a249-ec574c0d0000 pid=3404 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=91ed7718-1b00-0000-a249-ec574c0d0000 pid=3404 clone guuid=5c138418-1b00-0000-a249-ec574d0d0000 pid=3405 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=5c138418-1b00-0000-a249-ec574d0d0000 pid=3405 execve guuid=7d7fc918-1b00-0000-a249-ec574e0d0000 pid=3406 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=7d7fc918-1b00-0000-a249-ec574e0d0000 pid=3406 execve guuid=d34bf225-1b00-0000-a249-ec576c0d0000 pid=3436 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=d34bf225-1b00-0000-a249-ec576c0d0000 pid=3436 execve guuid=4b76e226-1b00-0000-a249-ec576e0d0000 pid=3438 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=4b76e226-1b00-0000-a249-ec576e0d0000 pid=3438 clone guuid=bccafe26-1b00-0000-a249-ec57700d0000 pid=3440 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=bccafe26-1b00-0000-a249-ec57700d0000 pid=3440 execve guuid=3c0f6b27-1b00-0000-a249-ec57710d0000 pid=3441 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=3c0f6b27-1b00-0000-a249-ec57710d0000 pid=3441 execve guuid=241fe034-1b00-0000-a249-ec578c0d0000 pid=3468 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=241fe034-1b00-0000-a249-ec578c0d0000 pid=3468 execve guuid=38222435-1b00-0000-a249-ec578d0d0000 pid=3469 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=38222435-1b00-0000-a249-ec578d0d0000 pid=3469 clone guuid=257f3335-1b00-0000-a249-ec578e0d0000 pid=3470 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=257f3335-1b00-0000-a249-ec578e0d0000 pid=3470 execve guuid=4f219735-1b00-0000-a249-ec578f0d0000 pid=3471 /usr/bin/wget net guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=4f219735-1b00-0000-a249-ec578f0d0000 pid=3471 execve guuid=46b2d242-1b00-0000-a249-ec57a50d0000 pid=3493 /usr/bin/chmod guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=46b2d242-1b00-0000-a249-ec57a50d0000 pid=3493 execve guuid=ebe01743-1b00-0000-a249-ec57a60d0000 pid=3494 /usr/bin/dash guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=ebe01743-1b00-0000-a249-ec57a60d0000 pid=3494 clone guuid=c2d82643-1b00-0000-a249-ec57a70d0000 pid=3495 /usr/bin/rm guuid=c6b9761e-1800-0000-a249-ec57a0070000 pid=1952->guuid=c2d82643-1b00-0000-a249-ec57a70d0000 pid=3495 execve 02664095-01bf-5a21-9704-c27895befb9b 23.251.34.31:80 guuid=654dc61e-1800-0000-a249-ec57a1070000 pid=1953->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=316b8151-1800-0000-a249-ec570a080000 pid=2058->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=98267c80-1800-0000-a249-ec577e080000 pid=2174->02664095-01bf-5a21-9704-c27895befb9b send: 140B guuid=42ff50af-1800-0000-a249-ec57d5080000 pid=2261->02664095-01bf-5a21-9704-c27895befb9b send: 140B guuid=61ab45dd-1800-0000-a249-ec5733090000 pid=2355->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=ea641a0c-1900-0000-a249-ec5790090000 pid=2448->02664095-01bf-5a21-9704-c27895befb9b send: 140B guuid=d408143a-1900-0000-a249-ec57030a0000 pid=2563->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=1cf63c6a-1900-0000-a249-ec576d0a0000 pid=2669->02664095-01bf-5a21-9704-c27895befb9b send: 140B guuid=83828599-1900-0000-a249-ec57ba0a0000 pid=2746->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=4cbb2dc8-1900-0000-a249-ec571a0b0000 pid=2842->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=a00ab5f6-1900-0000-a249-ec57760b0000 pid=2934->02664095-01bf-5a21-9704-c27895befb9b send: 140B guuid=a61d4226-1a00-0000-a249-ec57e90b0000 pid=3049->02664095-01bf-5a21-9704-c27895befb9b send: 141B guuid=b206bc56-1a00-0000-a249-ec572b0c0000 pid=3115->02664095-01bf-5a21-9704-c27895befb9b send: 141B dc4e61eb-ed14-57df-bc63-b6789a546e6b 220.158.234.220:80 guuid=dda6e886-1a00-0000-a249-ec57590c0000 pid=3161->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=b4594096-1a00-0000-a249-ec57670c0000 pid=3175->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=16c01ba4-1a00-0000-a249-ec577d0c0000 pid=3197->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=bca65eb4-1a00-0000-a249-ec57940c0000 pid=3220->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=489873c2-1a00-0000-a249-ec57b40c0000 pid=3252->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=548968d0-1a00-0000-a249-ec57d00c0000 pid=3280->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=b507d5e0-1a00-0000-a249-ec57e30c0000 pid=3299->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=ea2162ef-1a00-0000-a249-ec57050d0000 pid=3333->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=fb8b9bfc-1a00-0000-a249-ec570b0d0000 pid=3339->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=6e02e90a-1b00-0000-a249-ec572a0d0000 pid=3370->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=7d7fc918-1b00-0000-a249-ec574e0d0000 pid=3406->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=3c0f6b27-1b00-0000-a249-ec57710d0000 pid=3441->dc4e61eb-ed14-57df-bc63-b6789a546e6b con guuid=4f219735-1b00-0000-a249-ec578f0d0000 pid=3471->dc4e61eb-ed14-57df-bc63-b6789a546e6b con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-08-11 09:47:32 UTC
File Type:
Text (Shell)
AV detection:
20 of 36 (55.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h5ykj46tnokscbtpqdvx34fua2hofhnyfemhtyv232y7tecjoqgq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260811-lses9swxgt/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d

(this sample)

Gafgyt

elf 408026ea525490fd64312ace9e65d433ce6f0f43f3ae833834261aade507c2d6

  
URLhaus
https://urlhaus.abuse.ch/url/3901477/
  
Delivery method
Distributed via web download
  
Dropping
MD5 499dbac69938569ded0518282643bae2
  
Dropping
SHA256 408026ea525490fd64312ace9e65d433ce6f0f43f3ae833834261aade507c2d6

Comments