MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950
SHA3-384 hash:	27e8f75aa2bc391af36a659722d5395940d61624bdf7ffc1f527438b5c29df8290ce2d65fa19346edda74d3938fd0a04
SHA1 hash:	ee064a7ea146d7b563bed9b2dac7981b8a6ffc4a
MD5 hash:	35d3e4e500a8378165360b8d454d0c0a
humanhash:	ceiling-crazy-enemy-foxtrot
File name:	t
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'582 bytes
First seen:	2024-12-28 20:11:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2gnv5YLkUe5p3YLy+IUbMuLlxM+GVMYLt2mNYLOhvYLC+OuLoR+OlYL12gGp:sF+hnvc2mxIEAHLtNYs6+EHl7ztJQ
TLSH	T148310FC551A248F03DF19D4BB36BCC1EB24A358E1DC98F89A9CC30F6698EC50B411723
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.146/x86_64	a98c75b7612614ed742dc20e8606ccfbf3e9e420db04a51de199febf79df432a	Mirai	elf gafgyt mirai
http://83.222.191.146/mpsl	2334f9ff33a1a40363409037d38200e7ab05d17e45b0c34d2fa9fdfba0981184	Mirai	elf mirai
http://83.222.191.146/mips	1a277c37236c7f81798518774b8a503060f075c2f5f80d8891737f099568b0cd	Mirai	elf gafgyt mirai
http://83.222.191.146/arm4	1a742066ad19b17d888000e4afc3ae71232c46846604f2ef9385d92a45c7908e	Mirai	elf gafgyt mirai
http://83.222.191.146/arm5	eec96d97e6867412ad5b49487ec4d11996c2e76dda69f6802e90d417956a173b	Mirai	elf gafgyt mirai
http://83.222.191.146/arm6	10168506319b8be5589155349a7fea42791d64bd90ab610747d473a056e4ec3d	Mirai	elf mirai
http://83.222.191.146/arm7	ddaa4a6fbb91a9fe3eeb6971840e677e2f131cb10d3bb423cfe563560f04ebdd	Mirai	elf gafgyt mirai
http://83.222.191.146/m68k	3a353240939bc7ca326e9ed1c640f99517b5c1779a660b053fcf3266881c7852	Mirai	elf mirai
http://83.222.191.146/x86	06858102f6c443b53241baa576c4ecfce5c61bd729379fea88a40323227ee34a	Mirai	elf mirai
http://83.222.191.146/spc	8cc0e7a4a92d334f4df94cf382385ea5f59866b5e32097f0ac96b3f3c15b2b27	Mirai	elf mirai
http://83.222.191.146/ppc	e2286c2fc91b4bd4780c7f35ab12af96397b0701dc051739684bf0c3b7c67360	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677106ad1bb06b8884793322linux22vpnfull_triage

Tags:

shellcode virus html

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug busybox evasive expand lolbin remote

Link:

https://www.filescan.io/uploads/67705b9804d70cdf80d81ba1/reports/7bfea1ec-8ad7-4de3-9287-d6c8f77498c8/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950

Result

Verdict:

UNKNOWN

Score:

70%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2024-12-28 20:48:58 UTC

File Type:

Text (Shell)

AV detection:

14 of 23 (60.87%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7s5xy2ou7kjxlctkvhcvrg77buoc4a2yevonuiebrdx2yzgnfia._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5fe5dbe34ea7d49bac53554e2ac4dff868e1701ac12ae6d1040c477d63266950

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.