MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184
SHA3-384 hash:	080b6fb8e8231d8e80209840411045e671e5bea7ba0503857c5e455c7a402639ba2aba1170a1be374c050f2eeedcd589
SHA1 hash:	313e4dadd1209dfee114f1cfe40d426063368337
MD5 hash:	24bbaab2d34a3903feb28d2f29a15c38
humanhash:	romeo-gee-georgia-william
File name:	fuckjewishpeople.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'035 bytes
First seen:	2025-04-26 13:53:12 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:UufgNA5bKzATNd4tC5SLc5yJ6TERdS1f1A1V1a1hUBaXevwFqxgTfvYNI:UufgNA5uzATNd4tC5SLc5yJ6TERc1f1l
TLSH	T1CB415B4B73DBA625EEE7E472749060202383C489D0ED9B4CF6E935CDD0A9CA4736A5C2
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://156.253.227.62/fuckjewishpeople.mips	c6ef0b4aad5a272cbbb6e1f305dfa66860b12f3bdb659f9a3aba4d17d98d444f	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.mpsl	448497005a8e29b62b13a948a0a380e2c7f729fddb1f5b2b3d20ca36b0da940c	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.x86	20ac4542f8084f31bf327f53eb77cf3bf62c13a4f81896d41c8f4d9d0f243ad3	Ladvix	censys elf ladvix ua-wget
http://156.253.227.62/fuckjewishpeople.ppc	n/a	n/a	censys elf ua-wget
http://156.253.227.62/fuckjewishpeople.sparc	107a7be3e5f2771bd6e7e649cd9db20ab9c5bbd8f1cb0a891989b7dfdd64db06	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.arm4	33a296d63d4960fa1e4cfdd8ab442b1c12a05aa291a10bc66262f69e3b292c5d	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.arm5	9a5ba03d1ebefd585836a591674db613e6ab3647ea288b1c002a96c9280bc337	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.arm6	9871f430ea86c08b2a4ae8952f892579684858f2fbcd6d6922a5c8b349a5444c	Gafgyt	censys elf gafgyt ua-wget
http://156.253.227.62/fuckjewishpeople.arm7	2b9a413dd90e4e84ad97cd67f03c4f64e77f24537cbf2364169e1877320056bc	Gafgyt	censys elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680ce61dcc5fb3600cc2b4b8linux22vpnfull_triage

Tags:

downloader agent hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/680ce55a212716475faf42f7/reports/ce94b5bf-7f03-4033-897c-23513cc6b371/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184/

Threat name:

Linux.Trojan.Geninst

Status:

Malicious

First seen:

2025-04-26 13:54:16 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ozmmj56vw4emw42f6hh3jutmkdb664fhlkzfwg7rxxnp5jd4ygca._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250426-q64rrsvshv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.