🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee
SHA3-384 hash: 6a9cd9ab817e860e63ed2066fc4b90b5000ddcc44559c71a4712d2c8a159db096f319180373ab6f2de13def8bfdec1f0
SHA1 hash: 579eaa357d3f31b15f0fa1da52eba97f98bc6a29
MD5 hash: 1963677292efd88bf60d0c687cb0382f
humanhash: maryland-low-glucose-mirror
File name:bins.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:1'214 bytes
First seen:2026-10-05 11:06:57 UTC
Last seen:2026-10-06 00:13:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:q0F2kV3sbVHW0F2govvo0F24tDX0F2JgfX0F2RzB+RFX0F4DO0F2WNI3ewkX0F2d:vKVeJbI/s+VG+4DLTNIpks2KYBbIKAw
TLSH T15F213ED751E20A36AC65D877B4AF8CA434D0E4C645E1BF0818EC38F4648DE59E481B93
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://104.168.4.206/dissmips65988926d1a02d38a6c08ee0e0dbb966dabcb337aff3344c635fd53e43512d8d Miraicensys elf gafgyt mirai ua-wget
http://104.168.4.206/dissmpsl2fbd50ef3b12511425f2ee45e07b39c11fa261953ebfec45d4a31426148320fa Miraicensys elf gafgyt mirai ua-wget
http://104.168.4.206/disssh435e9f2443d7fa3c500ab7be64d9ffb5f90fd30453f4e4d3adfe43b6ecce8330e Miraicensys elf mirai ua-wget
http://104.168.4.206/dissx86b9b00a11b0bdecee5e9e1a56a89611267cc5881b258196e4df6166372ba1ea98 Miraicensys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm4d849fb8000891cf3cca1b755eac2eda328135ae73041cfcd6f7eb612f6b9ab20 Gafgytcensys elf gafgyt mirai ua-wget
http://104.168.4.206/adissarm5d9a4f09acbe5baf37d129ddc8a22c25a2fb42c3437667ad676ea3a08e4d0371c Miraicensys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm61fdac0e0f2fda9d161056beab78fa1c4fc82216e1158eeb8ecabc643139a7fc3 Miraicensys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm78d88cda5439279eb70e789a8718f8f27a40d328bc674d6d5197731935dbd16a5 Miraicensys elf mirai ua-wget
http://104.168.4.206/adb.arm7273b6cd05d03c82d836d6ad298bfae66a696ca857856b9f9bf5c77e8d1fee949 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6ac384e836412e623d2c7936/reports/fe125e35-45dd-4a49-a8af-c042ee755e6c/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-05T08:20:00Z UTC
Last seen:
2026-10-06T19:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f1b1cf1e-4c36-4b00-baf2-88e95ac8f018
Behavior Graph:
Download SVG
%3 guuid=ecfc5b69-1600-0000-72c4-36d0e60c0000 pid=3302 /usr/bin/sudo guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308 /tmp/sample.bin guuid=ecfc5b69-1600-0000-72c4-36d0e60c0000 pid=3302->guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308 execve guuid=3f08446b-1600-0000-72c4-36d0ee0c0000 pid=3310 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=3f08446b-1600-0000-72c4-36d0ee0c0000 pid=3310 execve guuid=d8be5e90-1600-0000-72c4-36d03f0d0000 pid=3391 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=d8be5e90-1600-0000-72c4-36d03f0d0000 pid=3391 execve guuid=002db590-1600-0000-72c4-36d0410d0000 pid=3393 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=002db590-1600-0000-72c4-36d0410d0000 pid=3393 clone guuid=13662e91-1600-0000-72c4-36d0450d0000 pid=3397 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=13662e91-1600-0000-72c4-36d0450d0000 pid=3397 execve guuid=e6ef6b91-1600-0000-72c4-36d0470d0000 pid=3399 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e6ef6b91-1600-0000-72c4-36d0470d0000 pid=3399 execve guuid=5315b7bb-1600-0000-72c4-36d0ac0d0000 pid=3500 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=5315b7bb-1600-0000-72c4-36d0ac0d0000 pid=3500 execve guuid=b0a704bc-1600-0000-72c4-36d0ae0d0000 pid=3502 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=b0a704bc-1600-0000-72c4-36d0ae0d0000 pid=3502 clone guuid=b10a8fbc-1600-0000-72c4-36d0b40d0000 pid=3508 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=b10a8fbc-1600-0000-72c4-36d0b40d0000 pid=3508 execve guuid=4564ebbc-1600-0000-72c4-36d0b60d0000 pid=3510 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=4564ebbc-1600-0000-72c4-36d0b60d0000 pid=3510 execve guuid=af67f9e0-1600-0000-72c4-36d0100e0000 pid=3600 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=af67f9e0-1600-0000-72c4-36d0100e0000 pid=3600 execve guuid=2f093fe1-1600-0000-72c4-36d0110e0000 pid=3601 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=2f093fe1-1600-0000-72c4-36d0110e0000 pid=3601 clone guuid=aaf8cde1-1600-0000-72c4-36d0160e0000 pid=3606 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=aaf8cde1-1600-0000-72c4-36d0160e0000 pid=3606 execve guuid=476e19e2-1600-0000-72c4-36d01a0e0000 pid=3610 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=476e19e2-1600-0000-72c4-36d01a0e0000 pid=3610 execve guuid=43ce4408-1700-0000-72c4-36d0920e0000 pid=3730 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=43ce4408-1700-0000-72c4-36d0920e0000 pid=3730 execve guuid=2f86c808-1700-0000-72c4-36d0930e0000 pid=3731 /tmp/dissx86 guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=2f86c808-1700-0000-72c4-36d0930e0000 pid=3731 execve guuid=e795f908-1700-0000-72c4-36d0960e0000 pid=3734 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e795f908-1700-0000-72c4-36d0960e0000 pid=3734 execve guuid=3c79780a-1700-0000-72c4-36d09c0e0000 pid=3740 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=3c79780a-1700-0000-72c4-36d09c0e0000 pid=3740 execve guuid=4c220332-1700-0000-72c4-36d01c0f0000 pid=3868 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=4c220332-1700-0000-72c4-36d01c0f0000 pid=3868 execve guuid=646f4432-1700-0000-72c4-36d01d0f0000 pid=3869 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=646f4432-1700-0000-72c4-36d01d0f0000 pid=3869 clone guuid=819fe832-1700-0000-72c4-36d0250f0000 pid=3877 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=819fe832-1700-0000-72c4-36d0250f0000 pid=3877 execve guuid=3b3f3233-1700-0000-72c4-36d0260f0000 pid=3878 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=3b3f3233-1700-0000-72c4-36d0260f0000 pid=3878 execve guuid=fc44bb59-1700-0000-72c4-36d0bb0f0000 pid=4027 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=fc44bb59-1700-0000-72c4-36d0bb0f0000 pid=4027 execve guuid=e84d285a-1700-0000-72c4-36d0bc0f0000 pid=4028 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e84d285a-1700-0000-72c4-36d0bc0f0000 pid=4028 clone guuid=6d63ef5a-1700-0000-72c4-36d0c40f0000 pid=4036 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=6d63ef5a-1700-0000-72c4-36d0c40f0000 pid=4036 execve guuid=a222365b-1700-0000-72c4-36d0c50f0000 pid=4037 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=a222365b-1700-0000-72c4-36d0c50f0000 pid=4037 execve guuid=9a0e2380-1700-0000-72c4-36d05a100000 pid=4186 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=9a0e2380-1700-0000-72c4-36d05a100000 pid=4186 execve guuid=846b6380-1700-0000-72c4-36d05c100000 pid=4188 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=846b6380-1700-0000-72c4-36d05c100000 pid=4188 clone guuid=c188e480-1700-0000-72c4-36d05e100000 pid=4190 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=c188e480-1700-0000-72c4-36d05e100000 pid=4190 execve guuid=e2252381-1700-0000-72c4-36d061100000 pid=4193 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e2252381-1700-0000-72c4-36d061100000 pid=4193 execve guuid=a8ed60a5-1700-0000-72c4-36d0eb100000 pid=4331 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=a8ed60a5-1700-0000-72c4-36d0eb100000 pid=4331 execve guuid=4e9faaa5-1700-0000-72c4-36d0ed100000 pid=4333 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=4e9faaa5-1700-0000-72c4-36d0ed100000 pid=4333 clone guuid=d5e388a6-1700-0000-72c4-36d0f2100000 pid=4338 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=d5e388a6-1700-0000-72c4-36d0f2100000 pid=4338 execve guuid=8dfeefa6-1700-0000-72c4-36d0f6100000 pid=4342 /usr/bin/wget net send-data write-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=8dfeefa6-1700-0000-72c4-36d0f6100000 pid=4342 execve guuid=e87edec3-1700-0000-72c4-36d063110000 pid=4451 /usr/bin/chmod guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e87edec3-1700-0000-72c4-36d063110000 pid=4451 execve guuid=dbd61ec4-1700-0000-72c4-36d067110000 pid=4455 /usr/bin/bash guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=dbd61ec4-1700-0000-72c4-36d067110000 pid=4455 clone guuid=e33cacc4-1700-0000-72c4-36d06c110000 pid=4460 /usr/bin/rm delete-file guuid=26ecee6a-1600-0000-72c4-36d0ec0c0000 pid=3308->guuid=e33cacc4-1700-0000-72c4-36d06c110000 pid=4460 execve 0d3a7397-9f16-5b6f-bfb3-119900c026d0 104.168.4.206:80 guuid=3f08446b-1600-0000-72c4-36d0ee0c0000 pid=3310->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B guuid=e6ef6b91-1600-0000-72c4-36d0470d0000 pid=3399->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B guuid=4564ebbc-1600-0000-72c4-36d0b60d0000 pid=3510->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 135B guuid=476e19e2-1600-0000-72c4-36d01a0e0000 pid=3610->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 135B guuid=1153ef08-1700-0000-72c4-36d0950e0000 pid=3733 /tmp/dissx86 net send-data write-file zombie guuid=2f86c808-1700-0000-72c4-36d0930e0000 pid=3731->guuid=1153ef08-1700-0000-72c4-36d0950e0000 pid=3733 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=1153ef08-1700-0000-72c4-36d0950e0000 pid=3733->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 8bffb074-0a94-5743-b355-539bce88d1b1 104.168.4.206:9987 guuid=1153ef08-1700-0000-72c4-36d0950e0000 pid=3733->8bffb074-0a94-5743-b355-539bce88d1b1 send: 87B guuid=3c79780a-1700-0000-72c4-36d09c0e0000 pid=3740->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B guuid=3b3f3233-1700-0000-72c4-36d0260f0000 pid=3878->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 137B guuid=a222365b-1700-0000-72c4-36d0c50f0000 pid=4037->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B guuid=e2252381-1700-0000-72c4-36d061100000 pid=4193->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B guuid=8dfeefa6-1700-0000-72c4-36d0f6100000 pid=4342->0d3a7397-9f16-5b6f-bfb3-119900c026d0 send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-10-05 11:07:31 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=myp25yhhyxevs4snydntbj3luz5vzdxs33drqdvs6ze54557phxa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/261005-m7475s1cmb/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee

(this sample)

Gafgyt

elf 6cc5fadd255dbe4a2ba75a297a8e714e47dc85ec1acddab3be3d37866e918872

  
URLhaus
https://urlhaus.abuse.ch/url/3927792/
  
Delivery method
Distributed via web download
  
Dropping
MD5 14a04b7659e8e9acf28b8f56938afc6a
  
Dropping
SHA256 6cc5fadd255dbe4a2ba75a297a8e714e47dc85ec1acddab3be3d37866e918872

Comments