MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da
SHA3-384 hash:	89399364189aa0fe80936eec49358996c80ff22870db22b64cdf769ac0793d39aee68a5ea61c1a86fe31e3f13e850e86
SHA1 hash:	440cc2efdc15e59906fee5fcffe10c7accff9474
MD5 hash:	fbef3534216eab7ba740787e33ecf41c
humanhash:	crazy-whiskey-sierra-tennessee
File name:	billjenkinbins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'818 bytes
First seen:	2025-10-27 15:03:44 UTC
Last seen:	2025-10-27 18:30:26 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v8b8P8lt4k8Tb8D8X8D84+8P8v38l3J8P8D8mbCoR:veS64kybOq22yO3G6GHbCG
TLSH	T1AF31B6CB71A14AB06CE5E967326B841878E6E98F15CE5F992DDC3CEE448DE04F400693
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.111.78.190/mips	bbe754bdc0007074a6842da135b4a769ec30baa9af19f18c6ff12faf3540cdd7	Gafgyt	32-bit elf gafgyt mirai Mozi
http://193.111.78.190/mipsel	b1eb759a7c7ac1830d8c04946f7740ad900fc3e31870564f83d2aaae36d9d999	Gafgyt	32-bit elf gafgyt mirai Mozi
http://193.111.78.190/sh4	8a3135a31091a9d317fbb536ed94310c307b9b493f4954953dac53d0fe60e9a4	Gafgyt	elf gafgyt mirai
http://193.111.78.190/x86	5787bbb99240daa317c72428a3ac67e09b373e330d9ed5ded028dbff0cad433c	Gafgyt	64-bit elf gafgyt mirai Mozi
http://193.111.78.190/armv7l	381a06421c1fac9769bad62ccb5e767213fcf01387b408aceb31f4c0065ed4b2	Mirai	elf mirai
http://193.111.78.190/armv6l	72668ded26057a237c837010f0d418d04181a2b149ef6a930443bb9f54acd23a	Mirai	elf mirai
http://193.111.78.190/i686	2ff8c36c9f560f4581cadf36d0c9da4af28c05150ef7708e5f9313cfaa8834c0	Gafgyt	elf gafgyt mirai
http://193.111.78.190/powerpc	5eff391e4cb52d4d3af437e34577454d6e99f0cafc4a24716c1989e3917d3816	Gafgyt	elf gafgyt mirai
http://193.111.78.190/i586	a7c10641952b8d897ff4e9062eb9f039047cbf96cec7e0f91272e9d0575060d9	Gafgyt	elf gafgyt mirai
http://193.111.78.190/m68k	7dae24c931238078062cb04bf1e5da2726ba0a74f6785f229810f28882af03b0	Gafgyt	elf gafgyt mirai
http://193.111.78.190/sparc	n/a	n/a	elf ua-wget
http://193.111.78.190/armv4l	c709533669f6d2d61cdeb1e02469621d22c1158897a8bfa2e5bd951f3705b3b6	Gafgyt	elf gafgyt mirai
http://193.111.78.190/armv5l	700976fd32b0e4fcb19b97198897a47d4207591bfd445ea1efa9604f9d07771c	Gafgyt	elf gafgyt mirai
http://193.111.78.190/powerpc-440fp	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-27T12:34:00Z UTC

Last seen:

2025-10-28T10:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7c3116fa-703f-4729-af2a-0bc85c720c93

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-10-27 14:56:56 UTC

File Type:

Text (Shell)

AV detection:

25 of 38 (65.79%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jiqn3yiqryv44nrwn56nhba3vr5y6mhhjav4iqmv5yfjoifsoxna._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/251027-sggbaafy5b/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (70509) amount of remote hosts

Creates a large amount of network flows

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.