🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80
SHA3-384 hash: 41edb4facdf9eb9d1814ba53aa6d4c9ea03b62ba5c88190b894da8bc5eaa782d939b8f14ffd9197faeb79bc7cc40344a
SHA1 hash: d678c984ab4a3d34ab24581feb618560b234fa00
MD5 hash: 3fa9ba8836dd4e6df48cda26ec6158af
humanhash: mirror-lamp-timing-august
File name:mbupload-89rsp_u3.bin
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'540 bytes
First seen:2026-10-07 18:03:02 UTC
Last seen:2026-10-08 02:55:45 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:q0FkFV0FkT0Fkrc43fX0FkAeekX0FkDWk0Fk/X0FkJ1FZ0FkHSzEX0FkAi0FkPVB:vQ+/6c4kDasYUiso+gSzEs/3FJYUYT
TLSH T16531BBCE23A1C5F0AEA4A92BB66A8D10F4E5EDC719C59F582CEC38F9448CD047431697
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter wristhulk
Tags:cowrie Downloader gafgyt honeypot sh


Avatar
wristhulk
Captured by a Cowrie honeypot at 2026-10-07 18:02:32 UTC, downloaded from http://103.238.235.250/telnetbins.sh by 103.238.235.250.
URLMalware sample (SHA256 hash)SignatureTags
http://103.238.235.250/mipsn/an/acowrie honeypot
http://103.238.235.250/mipseln/an/acowrie honeypot
http://103.238.235.250/sh4n/an/acowrie honeypot
http://103.238.235.250/x86n/an/acowrie honeypot
http://103.238.235.250/armv6lc211d66c50f18e14970d242f3cfa69928c4b2c0cd514b323f6157c9ae4b8e7e1 Miraielf ua-wget
http://103.238.235.250/i686n/an/aelf ua-wget
http://103.238.235.250/powerpcn/an/aelf ua-wget
http://103.238.235.250/i586n/an/aelf ua-wget
http://103.238.235.250/m68kn/an/aelf ua-wget
http://103.238.235.250/sparcn/an/aelf ua-wget
http://103.238.235.250/armv4ln/an/aelf ua-wget
http://103.238.235.250/armv5ln/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6ac689732db7b0ff5b5c860e/reports/19e3ffdd-4846-44f0-90a9-ed1e9bd81107/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cab1d19a-c692-4c21-8d15-64796aec879a
Behavior Graph:
Download SVG
%3 guuid=9c9d5b1c-1900-0000-9be8-3cd87e0c0000 pid=3198 /usr/bin/sudo guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205 /tmp/sample.bin guuid=9c9d5b1c-1900-0000-9be8-3cd87e0c0000 pid=3198->guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205 execve guuid=13459621-1900-0000-9be8-3cd8860c0000 pid=3206 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=13459621-1900-0000-9be8-3cd8860c0000 pid=3206 execve guuid=392a6547-1900-0000-9be8-3cd8bd0c0000 pid=3261 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=392a6547-1900-0000-9be8-3cd8bd0c0000 pid=3261 execve guuid=4cc4d547-1900-0000-9be8-3cd8bf0c0000 pid=3263 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=4cc4d547-1900-0000-9be8-3cd8bf0c0000 pid=3263 clone guuid=e55ffe47-1900-0000-9be8-3cd8c00c0000 pid=3264 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=e55ffe47-1900-0000-9be8-3cd8c00c0000 pid=3264 execve guuid=3ca76148-1900-0000-9be8-3cd8c20c0000 pid=3266 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=3ca76148-1900-0000-9be8-3cd8c20c0000 pid=3266 execve guuid=aa0a2769-1900-0000-9be8-3cd8280d0000 pid=3368 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=aa0a2769-1900-0000-9be8-3cd8280d0000 pid=3368 execve guuid=f1a78269-1900-0000-9be8-3cd82a0d0000 pid=3370 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=f1a78269-1900-0000-9be8-3cd82a0d0000 pid=3370 clone guuid=c9bca069-1900-0000-9be8-3cd82b0d0000 pid=3371 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c9bca069-1900-0000-9be8-3cd82b0d0000 pid=3371 execve guuid=c281fd69-1900-0000-9be8-3cd82d0d0000 pid=3373 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c281fd69-1900-0000-9be8-3cd82d0d0000 pid=3373 execve guuid=c1b4be84-1900-0000-9be8-3cd8570d0000 pid=3415 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c1b4be84-1900-0000-9be8-3cd8570d0000 pid=3415 execve guuid=1b6a2285-1900-0000-9be8-3cd8580d0000 pid=3416 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=1b6a2285-1900-0000-9be8-3cd8580d0000 pid=3416 clone guuid=5f463b85-1900-0000-9be8-3cd8590d0000 pid=3417 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=5f463b85-1900-0000-9be8-3cd8590d0000 pid=3417 execve guuid=cd899385-1900-0000-9be8-3cd85a0d0000 pid=3418 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=cd899385-1900-0000-9be8-3cd85a0d0000 pid=3418 execve guuid=eca179a1-1900-0000-9be8-3cd8890d0000 pid=3465 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=eca179a1-1900-0000-9be8-3cd8890d0000 pid=3465 execve guuid=2961c6a1-1900-0000-9be8-3cd88a0d0000 pid=3466 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=2961c6a1-1900-0000-9be8-3cd88a0d0000 pid=3466 clone guuid=cc23dfa1-1900-0000-9be8-3cd88b0d0000 pid=3467 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=cc23dfa1-1900-0000-9be8-3cd88b0d0000 pid=3467 execve guuid=fa3f2aa2-1900-0000-9be8-3cd88d0d0000 pid=3469 /usr/bin/wget net send-data write-file guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=fa3f2aa2-1900-0000-9be8-3cd88d0d0000 pid=3469 execve guuid=7df33fee-1900-0000-9be8-3cd8480e0000 pid=3656 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=7df33fee-1900-0000-9be8-3cd8480e0000 pid=3656 execve guuid=adf7cbee-1900-0000-9be8-3cd84a0e0000 pid=3658 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=adf7cbee-1900-0000-9be8-3cd84a0e0000 pid=3658 clone guuid=b3239def-1900-0000-9be8-3cd84d0e0000 pid=3661 /usr/bin/rm delete-file guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=b3239def-1900-0000-9be8-3cd84d0e0000 pid=3661 execve guuid=049de5ef-1900-0000-9be8-3cd84f0e0000 pid=3663 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=049de5ef-1900-0000-9be8-3cd84f0e0000 pid=3663 execve guuid=38ed8409-1a00-0000-9be8-3cd8a60e0000 pid=3750 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=38ed8409-1a00-0000-9be8-3cd8a60e0000 pid=3750 execve guuid=05a2af0a-1a00-0000-9be8-3cd8ad0e0000 pid=3757 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=05a2af0a-1a00-0000-9be8-3cd8ad0e0000 pid=3757 clone guuid=39a9fc0a-1a00-0000-9be8-3cd8af0e0000 pid=3759 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=39a9fc0a-1a00-0000-9be8-3cd8af0e0000 pid=3759 execve guuid=b4b0510b-1a00-0000-9be8-3cd8b10e0000 pid=3761 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=b4b0510b-1a00-0000-9be8-3cd8b10e0000 pid=3761 execve guuid=8fb5d025-1a00-0000-9be8-3cd8190f0000 pid=3865 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=8fb5d025-1a00-0000-9be8-3cd8190f0000 pid=3865 execve guuid=17e81a26-1a00-0000-9be8-3cd81a0f0000 pid=3866 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=17e81a26-1a00-0000-9be8-3cd81a0f0000 pid=3866 clone guuid=77903226-1a00-0000-9be8-3cd81b0f0000 pid=3867 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=77903226-1a00-0000-9be8-3cd81b0f0000 pid=3867 execve guuid=ddae6c26-1a00-0000-9be8-3cd81d0f0000 pid=3869 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=ddae6c26-1a00-0000-9be8-3cd81d0f0000 pid=3869 execve guuid=0232b740-1a00-0000-9be8-3cd87e0f0000 pid=3966 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=0232b740-1a00-0000-9be8-3cd87e0f0000 pid=3966 execve guuid=d66df740-1a00-0000-9be8-3cd8800f0000 pid=3968 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=d66df740-1a00-0000-9be8-3cd8800f0000 pid=3968 clone guuid=a5780841-1a00-0000-9be8-3cd8820f0000 pid=3970 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=a5780841-1a00-0000-9be8-3cd8820f0000 pid=3970 execve guuid=01683f41-1a00-0000-9be8-3cd8830f0000 pid=3971 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=01683f41-1a00-0000-9be8-3cd8830f0000 pid=3971 execve guuid=45a07d5c-1a00-0000-9be8-3cd8e40f0000 pid=4068 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=45a07d5c-1a00-0000-9be8-3cd8e40f0000 pid=4068 execve guuid=835fea5c-1a00-0000-9be8-3cd8e50f0000 pid=4069 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=835fea5c-1a00-0000-9be8-3cd8e50f0000 pid=4069 clone guuid=666b085d-1a00-0000-9be8-3cd8e60f0000 pid=4070 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=666b085d-1a00-0000-9be8-3cd8e60f0000 pid=4070 execve guuid=b7be535d-1a00-0000-9be8-3cd8e70f0000 pid=4071 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=b7be535d-1a00-0000-9be8-3cd8e70f0000 pid=4071 execve guuid=0de61c77-1a00-0000-9be8-3cd853100000 pid=4179 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=0de61c77-1a00-0000-9be8-3cd853100000 pid=4179 execve guuid=009ea977-1a00-0000-9be8-3cd857100000 pid=4183 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=009ea977-1a00-0000-9be8-3cd857100000 pid=4183 clone guuid=c952ca77-1a00-0000-9be8-3cd858100000 pid=4184 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c952ca77-1a00-0000-9be8-3cd858100000 pid=4184 execve guuid=c7553178-1a00-0000-9be8-3cd85c100000 pid=4188 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c7553178-1a00-0000-9be8-3cd85c100000 pid=4188 execve guuid=8345c393-1a00-0000-9be8-3cd8b1100000 pid=4273 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=8345c393-1a00-0000-9be8-3cd8b1100000 pid=4273 execve guuid=99850b94-1a00-0000-9be8-3cd8b4100000 pid=4276 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=99850b94-1a00-0000-9be8-3cd8b4100000 pid=4276 clone guuid=94372294-1a00-0000-9be8-3cd8b6100000 pid=4278 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=94372294-1a00-0000-9be8-3cd8b6100000 pid=4278 execve guuid=853f6694-1a00-0000-9be8-3cd8b9100000 pid=4281 /usr/bin/wget net send-data guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=853f6694-1a00-0000-9be8-3cd8b9100000 pid=4281 execve guuid=4d0539af-1a00-0000-9be8-3cd81e110000 pid=4382 /usr/bin/chmod guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=4d0539af-1a00-0000-9be8-3cd81e110000 pid=4382 execve guuid=c142d4af-1a00-0000-9be8-3cd822110000 pid=4386 /usr/bin/bash guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=c142d4af-1a00-0000-9be8-3cd822110000 pid=4386 clone guuid=1ac5f4af-1a00-0000-9be8-3cd824110000 pid=4388 /usr/bin/rm guuid=af381b21-1900-0000-9be8-3cd8850c0000 pid=3205->guuid=1ac5f4af-1a00-0000-9be8-3cd824110000 pid=4388 execve 254cf97a-e9fa-5dca-bbfb-b142853d8006 103.238.235.250:80 guuid=13459621-1900-0000-9be8-3cd8860c0000 pid=3206->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 134B guuid=3ca76148-1900-0000-9be8-3cd8c20c0000 pid=3266->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 136B guuid=c281fd69-1900-0000-9be8-3cd82d0d0000 pid=3373->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 133B guuid=cd899385-1900-0000-9be8-3cd85a0d0000 pid=3418->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 133B guuid=fa3f2aa2-1900-0000-9be8-3cd88d0d0000 pid=3469->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 136B guuid=049de5ef-1900-0000-9be8-3cd84f0e0000 pid=3663->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 134B guuid=b4b0510b-1a00-0000-9be8-3cd8b10e0000 pid=3761->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 137B guuid=ddae6c26-1a00-0000-9be8-3cd81d0f0000 pid=3869->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 134B guuid=01683f41-1a00-0000-9be8-3cd8830f0000 pid=3971->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 134B guuid=b7be535d-1a00-0000-9be8-3cd8e70f0000 pid=4071->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 135B guuid=c7553178-1a00-0000-9be8-3cd85c100000 pid=4188->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 136B guuid=853f6694-1a00-0000-9be8-3cd8b9100000 pid=4281->254cf97a-e9fa-5dca-bbfb-b142853d8006 send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-10-07 18:04:13 UTC
File Type:
Text (Shell)
AV detection:
24 of 36 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjfi3b3nqibxf3gp53ba6vvyta43j2jymsvz33qqfgp2h4xet2aa._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/261007-wnac4ats5p/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Reads system network configuration
Reads system routing table
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Detected Gafgyt variant
Family: Gafgyt/Bashlite
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 524a8d876d820372eccfeec20f56b89839b4e93864ab9dee10299fa3f2e49e80

(this sample)

Mirai

elf c211d66c50f18e14970d242f3cfa69928c4b2c0cd514b323f6157c9ae4b8e7e1

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3944390/
  
Dropping
MD5 e866fcde579ea912933150bdfab3b64b
  
Dropping
SHA256 c211d66c50f18e14970d242f3cfa69928c4b2c0cd514b323f6157c9ae4b8e7e1

Comments