MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81
SHA3-384 hash:	0574010f361a7ef9217f6c720e59d0d3d6dea7db19600400f014917934d0ee4201b9258f8491cb6239c439d7bfbb6564
SHA1 hash:	51397342544756d20834b149024c5cecda498926
MD5 hash:	4a1fbb1eb792c9694eb55b9f5031dbb4
humanhash:	carbon-missouri-kitten-india
File name:	t
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	162 bytes
First seen:	2025-08-28 07:33:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:LySC8Wj6cNOMBLIUL+mZIKzSHHa+L3Wj6cNOMBLIgIbZIKzSHHa+LQ:LySC8i6cN98jLxz3i6cN98IxzQ
TLSH	T19FC0126C0018A4B88D70FA52B2119C71E00D41C034740E48D6C80D704D569387060D8D
Magika	batch
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68b006f739a6221faa7276c1/reports/1fd2bf29-470b-4730-8b9e-4f6547501636/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

Link:

https://opentip.kaspersky.com/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6ab7598a-86e5-4c6b-868d-7b224f09588e

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iab6o5xe4mq6wyda6a4r65drlvknjirs2y2xn5xmv5774glhl2aq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250828-nvacns1thw/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4003e776e4e321eb6060f0391f74715d54d4a232d63576f6ecaf7ffe19675e81