MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249
SHA3-384 hash:	fe75e8574f20aeda9d7f2bbd4dda04428fd085c8f7743220692fabed451737f2049c620e3c39be49f7f243b0bf7f4f4e
SHA1 hash:	f8d922fd6f132619fc96ada50eda62340f60e49c
MD5 hash:	22eec1da91f20e8528dd659bc144d92d
humanhash:	eighteen-jupiter-venus-carpet
File name:	l
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'494 bytes
First seen:	2025-01-03 03:11:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2GvEDLkn5nuLy+LLlxM+HIpRLt2HI3KLOHIm8LC+HI6LoR3uOSL12KDLmRv1:sF+3vEfMtE3A1ZtTIC+zB/3frb+
TLSH	T1EA31F6D9A8B159B56DE0AC4F726FCD0D31AA798E1CC58F8968CC38F7A48CD50B944B13
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.90/x86_64	b75eab90673b94fd015bc817741fe37bfaee97166f5430e327c578bd57622349	Mirai	elf gafgyt mirai
http://83.222.191.90/mpsl	fb8c4375a130519b1efde83331104660d2e86beb26ea7fc0cff76eaa8ac92dcd	Mirai	elf gafgyt mirai
http://83.222.191.90/mips	834cc6baf7ebac043e45709e9b8f0f1392ec77636c35e4db9aa4c689e31e1c07	Mirai	elf gafgyt mirai
http://83.222.191.90/arm4	29d06b4e031c7f67717e1406e936132e62ec6756fbfb3385ff887a327afee967	Mirai	elf gafgyt mirai
http://83.222.191.90/arm5	a1a8c3f6c6d4fc6e12fd4d2a8e8752c0cfe7aaa90e995d26ae15e1817fa766e3	Mirai	elf gafgyt mirai
http://83.222.191.90/arm6	f6e83a004ecbe7fb573cbd4eb727cf9dd852f2e4f9881b7cdf2c8466619e1f73	Mirai	elf gafgyt mirai
http://83.222.191.90/arm7	1d7d6749e49dad1984f278f121649b964e9ebd5a02892ee2024469ce0fe2ff6e	Mirai	elf gafgyt mirai
http://83.222.191.90/m68k	87da76e636c2d9e189ad5459810887b367769a6aaba457f10ac57e936dd0dc96	Mirai	elf gafgyt mirai
http://83.222.191.90/x86	5e32cd9ca17361b8deea9202641ff4db44bbc56324ba81b880a457b62f892cac	Mirai	elf gafgyt mirai
http://83.222.191.90/spc	ac93db4801f970a44992f548c1f814b66aa02e596ba7f9eaf5bd6d5952fb36fc	Mirai	elf gafgyt mirai
http://83.222.191.90/ppc	73363cf068841767dd08e4caac4f5a2eca9b39a30c1e7efcb243e97c3c8b7292	Mirai	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67778a4a1ada707798257b47linux22vpnfull_triage

Tags:

malware

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash busybox evasive lolbin remote

Link:

https://www.filescan.io/uploads/67775588004d3628f624a74c/reports/c19b812a-7dfd-4df2-b7eb-170028bf4041/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249

Result

Verdict:

UNKNOWN

Score:

69%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-01-03 06:11:21 UTC

File Type:

Text (Shell)

AV detection:

19 of 38 (50.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l5z25ywwwkjkve6zu5b6jyvemiblgygi552lxuuuetjsmulncjeq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250103-hqxphstkex/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5f73aee2d6b292aa93d9a743e4e2a46202b360c8ef74bbd29424d326516d1249

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.