MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f
SHA3-384 hash:	6f517335ad7b888226c616fce7e05720472fe3350c80beaada1b96effb1f2506d0c35aa4cebc056e687da427c86d9b4c
SHA1 hash:	322a6f6b5e875691b73ec9fbbece437f2de5fbd0
MD5 hash:	3aebe01338d82e009a532bc082853d28
humanhash:	july-johnny-illinois-twelve
File name:	aaa
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'527 bytes
First seen:	2024-12-28 20:11:03 UTC
Last seen:	2024-12-28 22:16:04 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:sF+hnvKs2EsxSAHHstNmssIsgHxs7vstlsrn:eI8dByaqgwo
TLSH	T1A031D1C652A05CB92EE19C4BB26FCC0D314B75DE5CC99F8968CC30F66A8ED51B844B13
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.146/x86_64	a98c75b7612614ed742dc20e8606ccfbf3e9e420db04a51de199febf79df432a	Mirai	elf gafgyt mirai
http://83.222.191.146/mpsl	2334f9ff33a1a40363409037d38200e7ab05d17e45b0c34d2fa9fdfba0981184	Mirai	elf mirai
http://83.222.191.146/mips	1a277c37236c7f81798518774b8a503060f075c2f5f80d8891737f099568b0cd	Mirai	elf gafgyt mirai
http://83.222.191.146/arm4	1a742066ad19b17d888000e4afc3ae71232c46846604f2ef9385d92a45c7908e	Mirai	elf gafgyt mirai
http://83.222.191.146/arm5	eec96d97e6867412ad5b49487ec4d11996c2e76dda69f6802e90d417956a173b	Mirai	elf gafgyt mirai
http://83.222.191.146/arm6	10168506319b8be5589155349a7fea42791d64bd90ab610747d473a056e4ec3d	Mirai	elf mirai
http://83.222.191.146/arm7	ddaa4a6fbb91a9fe3eeb6971840e677e2f131cb10d3bb423cfe563560f04ebdd	Mirai	elf gafgyt mirai
http://83.222.191.146/m68k	3a353240939bc7ca326e9ed1c640f99517b5c1779a660b053fcf3266881c7852	Mirai	elf mirai
http://83.222.191.146/x86	06858102f6c443b53241baa576c4ecfce5c61bd729379fea88a40323227ee34a	Mirai	elf mirai
http://83.222.191.146/spc	8cc0e7a4a92d334f4df94cf382385ea5f59866b5e32097f0ac96b3f3c15b2b27	Mirai	elf mirai
http://83.222.191.146/ppc	e2286c2fc91b4bd4780c7f35ab12af96397b0701dc051739684bf0c3b7c67360	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677105f91bb06b88847932fflinux22vpnfull_triage

Tags:

phishing mirai

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug busybox evasive expand lolbin remote

Link:

https://www.filescan.io/uploads/67705b940dd45a148a40e1bb/reports/5cc2fea1-1734-4410-a55e-4d19d848884a/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f

Result

Verdict:

UNKNOWN

Score:

71%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2024-12-28 20:48:58 UTC

File Type:

Text (Shell)

AV detection:

14 of 23 (60.87%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nszm53344ugqnxqkz3sr47fklsbkkmgpmp273unimdgoq7g54bhq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6cb2ceef7ce50d06de0acee51e7caa5c82a530cf63f5fdd1a860cce87cdde04f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.