MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7
SHA3-384 hash:	44cba744a4e2ac24717846345c67769adca1c2493fe857e94a7048e4421844d70cd8d32963fcd56aeb7c94927977fa9c
SHA1 hash:	730f1a3927472991a65b35784a5c4c2716c7f18f
MD5 hash:	86d4ed5578e3157bc2c65e8795b69fa3
humanhash:	beryllium-solar-artist-alabama
File name:	ruck
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'538 bytes
First seen:	2025-01-03 03:31:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2GvOLkn5+Ly+3u+BlLlxM+HIppLt2HI3JoLOHImULC+HICQ+BlLoR3uOaL1A:sF+3vkMi39VA1htTJCCmdDVBPz7rje
TLSH	T1A231C4D9A4A158B6ADE1EC4F756BCC0D319A798F1CC58F8958CC38FAA08CE61F544B13
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.90/x86_64	b75eab90673b94fd015bc817741fe37bfaee97166f5430e327c578bd57622349	Mirai	elf gafgyt mirai
http://83.222.191.90/mpsl	fb8c4375a130519b1efde83331104660d2e86beb26ea7fc0cff76eaa8ac92dcd	Mirai	elf gafgyt mirai
http://83.222.191.90/mips	834cc6baf7ebac043e45709e9b8f0f1392ec77636c35e4db9aa4c689e31e1c07	Mirai	elf gafgyt mirai
http://83.222.191.90/arm4	29d06b4e031c7f67717e1406e936132e62ec6756fbfb3385ff887a327afee967	Mirai	elf gafgyt mirai
http://83.222.191.90/arm5	a1a8c3f6c6d4fc6e12fd4d2a8e8752c0cfe7aaa90e995d26ae15e1817fa766e3	Mirai	elf gafgyt mirai
http://83.222.191.90/arm6	f6e83a004ecbe7fb573cbd4eb727cf9dd852f2e4f9881b7cdf2c8466619e1f73	Mirai	elf gafgyt mirai
http://83.222.191.90/arm7	1d7d6749e49dad1984f278f121649b964e9ebd5a02892ee2024469ce0fe2ff6e	Mirai	elf gafgyt mirai
http://83.222.191.90/m68k	87da76e636c2d9e189ad5459810887b367769a6aaba457f10ac57e936dd0dc96	Mirai	elf gafgyt mirai
http://83.222.191.90/x86	5e32cd9ca17361b8deea9202641ff4db44bbc56324ba81b880a457b62f892cac	Mirai	elf gafgyt mirai
http://83.222.191.90/spc	ac93db4801f970a44992f548c1f814b66aa02e596ba7f9eaf5bd6d5952fb36fc	Mirai	elf gafgyt mirai
http://83.222.191.90/ppc	73363cf068841767dd08e4caac4f5a2eca9b39a30c1e7efcb243e97c3c8b7292	Mirai	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67778a4b1ada707798257b4dlinux22vpnfull_triage

Tags:

backdoor trojan hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash busybox evasive lolbin remote

Link:

https://www.filescan.io/uploads/67775a37004d3628f624a97c/reports/a8ddd728-c86a-49a0-8313-ee62f25d0a60/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7

Result

Verdict:

UNKNOWN

Score:

66%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-01-03 06:57:10 UTC

File Type:

Text (Shell)

AV detection:

14 of 23 (60.87%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=omdujjyojr3lnxgwqgkvcejgw33xsd6v4hv2b5h3ztatcwhou7lq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250103-hqxphswngp/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/730744a70e4c76b6dcd68195511126b6f7790fd5e1eba0f4fbccc13158eea7d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.