MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49
SHA3-384 hash:	20d423b154472752872f6f5103776c45bcd13c2e40c53ed6ef6666f282a1c7380aa6bc62639c070ecf5c498ed21f26b5
SHA1 hash:	bdb9c71f4ab91f8f9b59a0abcc50ab023e807236
MD5 hash:	962b010cd223ff0947729a851459b3c3
humanhash:	summer-nineteen-spring-network
File name:	Sakura.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'306 bytes
First seen:	2026-09-26 17:01:30 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vwMMd8jwMjttQdMwMKYwMhRwM/7wMcT6wM+CwMqIwMJL1wMT5NwMqIwMxxwMoT:vad8j9ttQdMEY7R57ST6QCcInBV5NcIQ
TLSH	T1B3415CC720570BF62E90ED33726A5480F5A8909EA5C65F0A68DC3DE884BEDFC68017D2
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://ertdyfiabwggujakd.duckdns.org/m-i.p-s.Sakura	0ea2fac5c14c082ba8942bc1770e5e4b82fa979c7de7ce11dbba614d9adbbbeb	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/m-p.s-l.Sakura	8aac189d8fabc0f3daf1d392f85d16935c2e4eec8d6c4b3c07d3e0a87be43f94	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/s-h.4-.Sakura	f582d9c7e19931ceb372a0b8cdf73f541da73e675b2e486b84af3e83dd14ced9	Gafgyt	gafgyt
http://ertdyfiabwggujakd.duckdns.org/x-8.6-.Sakura	f4749717ace70c07aa2915f1a9c90a142539f8e5f9317ee916caae4c1a0ab725	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/a-r.m-6.Sakura	8ff671eb42c9a82e3a17941c12c0eb02b5d9829803e8b98ee262ce981265790e	Gafgyt	gafgyt
http://ertdyfiabwggujakd.duckdns.org/x-3.2-.Sakura	9c874efbb0e12fb7fb1a46f1693e487b49cd2a5e828633a06097abfb3a3ee86f	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/a-r.m-7.Sakura	dbaa24a0ce77ca88132423b569ce6a45ae4a1443ce21e6b94f272aea2fdada63	Gafgyt	gafgyt
http://ertdyfiabwggujakd.duckdns.org/p-p.c-.Sakura	4e41dd913a15853e831ed027612ac3e7dfed8a79611fe622c32dcf9740708c88	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/i-5.8-6.Sakura	4c6931950a2c742d28fccef8d3bfeff9da07820cf88a5a466eb7304b809afea1	Gafgyt	gafgyt
http://ertdyfiabwggujakd.duckdns.org/m-6.8-k.Sakura	a4e61e06ef73ac181c35774c525cdb8a693b385c7787e3fcf1ed827cc0e96048	Gafgyt	gafgyt
http://ertdyfiabwggujakd.duckdns.org/a-r.m-4.Sakura	4e41dd913a15853e831ed027612ac3e7dfed8a79611fe622c32dcf9740708c88	Mirai	mirai
http://ertdyfiabwggujakd.duckdns.org/a-r.m-5.Sakura	717bf6071b344ac3e4df36b515190a18cbaa46f43063497d7c77c28b3ae621ae	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ab7fa98b5de7a67fd9e1316/reports/24af3151-d56d-402b-ba70-ad171ca19b0a/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-15T03:27:00Z UTC

Last seen:

2026-09-27T18:14:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/538ca0fd-3516-4435-9b93-b0ae3915b626

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-09-21 02:20:48 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ojr4ecyy5r2i4flflehh3gwetbayihlwuspfsh4zjpiujpvutveq._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260926-vj78wswy3m/

Behaviour

Writes file to tmp directory

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Detected Gafgyt variant

Family: Gafgyt/Bashlite

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/7263c20b18ec748e1565590e7d9ac49841841d76a49e591f994bd144beb49d49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.