MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91
SHA3-384 hash: a19a26bdcb119c7728acb1806d7bd9f797c41b0331c9ac422fe94e880e29faffe2612b207cb5b7370e1566b8fc260343
SHA1 hash: e149b70d9b5cb0a8547368a9012ba44f6a8ec6ca
MD5 hash: e872cc424dd43677ab052fad4cee9acb
humanhash: mango-oklahoma-cardinal-monkey
File name:utt
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'191 bytes
First seen:2025-08-23 01:49:53 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:E22IbO5zOt+MB0hQUQ7k1VOpOmk1VYfk1VYZ1Hk1VlSk1VDvDgkx:EAO5CEA0it7k10k1kk1eZBk1Ok1FLgkx
TLSH T1EC219DCF11918861DC5C998DB6430C18A4CEC9D529CFCE8CE7CD8536D8C9E0835A1F69
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.51.126.131/t/armv4l51dbfe5eb3331858e57320a5a2327599fc51d18bab6c76c5d7cb03ca4621078b Gafgytelf gafgyt opendir ua-wget
http://158.51.126.131/t/armv5lde0a93c843a18ba73b472730753ebd5d796d497f4c0b7533872aadce221f5d80 Gafgytelf gafgyt opendir ua-wget
http://158.51.126.131/t/armv7le3f59d94764653bbc6887c32ca43edcb670626c10502195d206f308b0684d428 Gafgytelf gafgyt opendir ua-wget
http://158.51.126.131/t/mips6039ff1c2c6d9a8675c66655fa98c08b461c5ed90b33de19648689c27a7a7756 Gafgytelf gafgyt ua-wget
http://158.51.126.131/t/mipsel48ec5f07842eb9840058755d90325aa23cdd67dca0f23c08faf79ea67918251d Gafgytelf gafgyt ua-wget
http://158.51.126.131/t/powerpc1564e24be14f2274b7827ef5ac78e442db334fbdf15e73a171dc6cf5186c3741 Gafgytelf gafgyt opendir ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/68a91e897137d6845838c51d/reports/a1ddee74-19b9-4f2f-846f-bf0e61a968e5/overview
Verdict:
Malicious
File Type:
ps1
First seen:
2025-08-23T02:09:00Z UTC
Last seen:
2025-08-23T02:09:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ca233878-b97c-463f-987b-2eaa2ee5d644
Behavior Graph:
Download SVG
%3 guuid=5eba8665-1900-0000-3ff6-9a61c3070000 pid=1987 /usr/bin/sudo guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992 /tmp/sample.bin guuid=5eba8665-1900-0000-3ff6-9a61c3070000 pid=1987->guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992 execve guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993 clone guuid=eb068b6a-1900-0000-3ff6-9a61d1070000 pid=2001 /usr/bin/rm delete-file guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=eb068b6a-1900-0000-3ff6-9a61d1070000 pid=2001 execve guuid=885ccd6a-1900-0000-3ff6-9a61d3070000 pid=2003 /usr/bin/rm delete-file guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=885ccd6a-1900-0000-3ff6-9a61d3070000 pid=2003 execve guuid=e8551c6b-1900-0000-3ff6-9a61d5070000 pid=2005 /usr/bin/rm delete-file guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=e8551c6b-1900-0000-3ff6-9a61d5070000 pid=2005 execve guuid=71655d6b-1900-0000-3ff6-9a61d6070000 pid=2006 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=71655d6b-1900-0000-3ff6-9a61d6070000 pid=2006 clone guuid=aa94b26c-1900-0000-3ff6-9a61db070000 pid=2011 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=aa94b26c-1900-0000-3ff6-9a61db070000 pid=2011 clone guuid=5084376d-1900-0000-3ff6-9a61dd070000 pid=2013 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=5084376d-1900-0000-3ff6-9a61dd070000 pid=2013 clone guuid=0146529a-1900-0000-3ff6-9a611c080000 pid=2076 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=0146529a-1900-0000-3ff6-9a611c080000 pid=2076 execve guuid=ed3e8b9a-1900-0000-3ff6-9a611d080000 pid=2077 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=ed3e8b9a-1900-0000-3ff6-9a611d080000 pid=2077 clone guuid=e3d1049b-1900-0000-3ff6-9a611f080000 pid=2079 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=e3d1049b-1900-0000-3ff6-9a611f080000 pid=2079 clone guuid=c4eb0ecd-1900-0000-3ff6-9a6179080000 pid=2169 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=c4eb0ecd-1900-0000-3ff6-9a6179080000 pid=2169 execve guuid=8f3848cd-1900-0000-3ff6-9a617b080000 pid=2171 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=8f3848cd-1900-0000-3ff6-9a617b080000 pid=2171 clone guuid=d850d0cd-1900-0000-3ff6-9a617e080000 pid=2174 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=d850d0cd-1900-0000-3ff6-9a617e080000 pid=2174 clone guuid=3e54afff-1900-0000-3ff6-9a6109090000 pid=2313 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=3e54afff-1900-0000-3ff6-9a6109090000 pid=2313 execve guuid=71c11000-1a00-0000-3ff6-9a610b090000 pid=2315 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=71c11000-1a00-0000-3ff6-9a610b090000 pid=2315 clone guuid=03568e00-1a00-0000-3ff6-9a610e090000 pid=2318 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=03568e00-1a00-0000-3ff6-9a610e090000 pid=2318 clone guuid=07c2ff32-1a00-0000-3ff6-9a6172090000 pid=2418 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=07c2ff32-1a00-0000-3ff6-9a6172090000 pid=2418 execve guuid=09d65533-1a00-0000-3ff6-9a6173090000 pid=2419 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=09d65533-1a00-0000-3ff6-9a6173090000 pid=2419 clone guuid=25d47934-1a00-0000-3ff6-9a6175090000 pid=2421 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=25d47934-1a00-0000-3ff6-9a6175090000 pid=2421 clone guuid=1f83b367-1a00-0000-3ff6-9a61ec090000 pid=2540 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=1f83b367-1a00-0000-3ff6-9a61ec090000 pid=2540 execve guuid=a9490368-1a00-0000-3ff6-9a61ee090000 pid=2542 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=a9490368-1a00-0000-3ff6-9a61ee090000 pid=2542 clone guuid=a8740369-1a00-0000-3ff6-9a61f0090000 pid=2544 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=a8740369-1a00-0000-3ff6-9a61f0090000 pid=2544 clone guuid=3d64fb9a-1a00-0000-3ff6-9a61720a0000 pid=2674 /usr/bin/chmod guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=3d64fb9a-1a00-0000-3ff6-9a61720a0000 pid=2674 execve guuid=d8f1459b-1a00-0000-3ff6-9a61740a0000 pid=2676 /usr/bin/dash guuid=af15d268-1900-0000-3ff6-9a61c8070000 pid=1992->guuid=d8f1459b-1a00-0000-3ff6-9a61740a0000 pid=2676 clone guuid=af2e5669-1900-0000-3ff6-9a61ca070000 pid=1994 /usr/bin/cat guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993->guuid=af2e5669-1900-0000-3ff6-9a61ca070000 pid=1994 execve guuid=af2a6169-1900-0000-3ff6-9a61cb070000 pid=1995 /usr/bin/grep guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993->guuid=af2a6169-1900-0000-3ff6-9a61cb070000 pid=1995 execve guuid=40d86c69-1900-0000-3ff6-9a61cc070000 pid=1996 /usr/bin/grep guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993->guuid=40d86c69-1900-0000-3ff6-9a61cc070000 pid=1996 execve guuid=d0fd7769-1900-0000-3ff6-9a61cd070000 pid=1997 /usr/bin/grep guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993->guuid=d0fd7769-1900-0000-3ff6-9a61cd070000 pid=1997 execve guuid=043b8a69-1900-0000-3ff6-9a61ce070000 pid=1998 /usr/bin/cut guuid=3b933869-1900-0000-3ff6-9a61c9070000 pid=1993->guuid=043b8a69-1900-0000-3ff6-9a61ce070000 pid=1998 execve guuid=8f5e656b-1900-0000-3ff6-9a61d8070000 pid=2008 /usr/bin/cp write-file guuid=71655d6b-1900-0000-3ff6-9a61d6070000 pid=2006->guuid=8f5e656b-1900-0000-3ff6-9a61d8070000 pid=2008 execve guuid=c71cbb6c-1900-0000-3ff6-9a61dc070000 pid=2012 /usr/bin/chmod guuid=aa94b26c-1900-0000-3ff6-9a61db070000 pid=2011->guuid=c71cbb6c-1900-0000-3ff6-9a61dc070000 pid=2012 execve guuid=c234446d-1900-0000-3ff6-9a61de070000 pid=2014 /usr/bin/wget net send-data write-file guuid=5084376d-1900-0000-3ff6-9a61dd070000 pid=2013->guuid=c234446d-1900-0000-3ff6-9a61de070000 pid=2014 execve 2beca644-24da-5e18-bc49-c06b8c4a111d 158.51.126.131:80 guuid=c234446d-1900-0000-3ff6-9a61de070000 pid=2014->2beca644-24da-5e18-bc49-c06b8c4a111d send: 137B guuid=8d1f0b9b-1900-0000-3ff6-9a6120080000 pid=2080 /usr/bin/wget net send-data write-file guuid=e3d1049b-1900-0000-3ff6-9a611f080000 pid=2079->guuid=8d1f0b9b-1900-0000-3ff6-9a6120080000 pid=2080 execve guuid=8d1f0b9b-1900-0000-3ff6-9a6120080000 pid=2080->2beca644-24da-5e18-bc49-c06b8c4a111d send: 137B guuid=eea8d5cd-1900-0000-3ff6-9a617f080000 pid=2175 /usr/bin/wget net send-data write-file guuid=d850d0cd-1900-0000-3ff6-9a617e080000 pid=2174->guuid=eea8d5cd-1900-0000-3ff6-9a617f080000 pid=2175 execve guuid=eea8d5cd-1900-0000-3ff6-9a617f080000 pid=2175->2beca644-24da-5e18-bc49-c06b8c4a111d send: 137B guuid=2d079400-1a00-0000-3ff6-9a610f090000 pid=2319 /usr/bin/wget net send-data write-file guuid=03568e00-1a00-0000-3ff6-9a610e090000 pid=2318->guuid=2d079400-1a00-0000-3ff6-9a610f090000 pid=2319 execve guuid=2d079400-1a00-0000-3ff6-9a610f090000 pid=2319->2beca644-24da-5e18-bc49-c06b8c4a111d send: 135B guuid=03de8534-1a00-0000-3ff6-9a6176090000 pid=2422 /usr/bin/wget net send-data write-file guuid=25d47934-1a00-0000-3ff6-9a6175090000 pid=2421->guuid=03de8534-1a00-0000-3ff6-9a6176090000 pid=2422 execve guuid=03de8534-1a00-0000-3ff6-9a6176090000 pid=2422->2beca644-24da-5e18-bc49-c06b8c4a111d send: 137B guuid=d2ea0b69-1a00-0000-3ff6-9a61f1090000 pid=2545 /usr/bin/wget net send-data write-file guuid=a8740369-1a00-0000-3ff6-9a61f0090000 pid=2544->guuid=d2ea0b69-1a00-0000-3ff6-9a61f1090000 pid=2545 execve guuid=d2ea0b69-1a00-0000-3ff6-9a61f1090000 pid=2545->2beca644-24da-5e18-bc49-c06b8c4a111d send: 138B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91/
Threat name:
Script.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-08-23 01:53:34 UTC
File Type:
Text (Shell)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mj6nqmc6izldv276vtnh5cpp3bjhnue4wbrpk35aeejbnhhv5siq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250823-ca921s1my9/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 627cd8305e46563aebfeacda7e89efd85276d09cb062f56fa02112169cf5ec91

(this sample)

Gafgyt

elf 9b8a4f2f10f8e7c07bb98f6e195a74b42fbaedd20c1a81c9a3eb21ef9774a66b

  
URLhaus
https://urlhaus.abuse.ch/url/3591801/
  
Delivery method
Distributed via web download
  
Dropping
MD5 ce5ad8dc72b323535034203e41d78a32
  
Dropping
SHA256 9b8a4f2f10f8e7c07bb98f6e195a74b42fbaedd20c1a81c9a3eb21ef9774a66b

Comments