MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7849a41a7a6c414bc96ddc7df4e6afd20bd0f2237d907522f858bfc53a607f04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	7849a41a7a6c414bc96ddc7df4e6afd20bd0f2237d907522f858bfc53a607f04
SHA3-384 hash:	ef6299d9dc825cf0cc58907e58c717bd67845e215f958dc408c02d9553957ac30d6619d0c6101ce5e32221931a412d4a
SHA1 hash:	8a96be28742737a616561c76eb5742e930ceffb7
MD5 hash:	1b2f9b0e0d700fab7e3a03e031693d98
humanhash:	moon-jig-pizza-xray
File name:	tbkdvr.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'880 bytes
First seen:	2025-06-14 14:49:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vGDDaMtz7qeNI7Ikstso/aGs6LMEgLNLIjxv+KP:vaWw7qnIJWo/Q6LMEuNLkv+g
TLSH	T1A74195DA326219752DE4ED3771EB98183480E1CB61C96F166CED3CF8A4CEE083425687
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.167.221.114/mips	fd2f0b1c70e97c3c67ab54ba87a2125fb30e25a6d6050cae36a5f7f14726189c	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/mipsel	d8253b55940a3d9f0a47c58ea5e1a37c1149217c7615d4a00bafc21d31035a19	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/sh4	f43693a946b59f1d132fc620b8fc3683433c87cb046207cb18aad68b4ea091d6	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/x86_64	d24eb20bdf28154c538be3ad296756f743753886e21a86f84e41482b7a4a45f3	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm6	e89afd876b71345828df07ef82a4e6684a26cd9d8dfe5d0ee139e367de3b7330	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/i686	476e3c2d0c589ce2372f3d1bbb59bd8f3d800847b545e360eb85a290d675e254	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/powerpc	880ddb6fcd0ef13b964069147f6b97b8bbd61cbe92feaf20aa25473179c50612	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/x86	857170c9591cce002273043a6f991f58683ef3bc2be7afcca54be1dc0097b57b	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/m68k	26b8ee688812ddc7257e35c1c071a3b7d9f9487d9638be829b9998ac0894d05d	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/spc	3be913565735d606fc2d64b098763b52ed9a6ba9ca93d89f723409b0348557eb	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm	5f83df06a5fd17487df62de3f9b939088dcb1d08d06ac762df888264ec9da0e8	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/arm5	235733c3b02759f01d846d0333b94b3dbf2fee43d843e46f4ce062c30421b606	Gafgyt	elf gafgyt ua-wget
http://104.167.221.114/ppc4fp	n/a	n/a	elf ua-wget
http://104.167.221.114/arm7	8d8e03d31f4169577641596c31ab5ab0990ef39aa5ffea486330b230632a737a	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684d8cc88bd5d68a12e8a05blinux22vpnfull_triage

Tags:

trojan agent overt

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4adf4419-fc1d-4a99-974a-a591c0da5b3a

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7849a41a7a6c414bc96ddc7df4e6afd20bd0f2237d907522f858bfc53a607f04

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7849a41a7a6c414bc96ddc7df4e6afd20bd0f2237d907522f858bfc53a607f04/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-06-13 07:25:36 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pbe2igt2nrauxsln3r67jzvp2if5b4rdpwihkixylc74kotap4ca._file

Result

Malware family:

n/a

Score:

9/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/250614-r92l9agm5v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Creates a large amount of network flows

Enumerates running processes

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Contacts a large (809) amount of remote hosts

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/7849a41a7a6c414bc96ddc7df4e6afd20bd0f2237d907522f858bfc53a607f04

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.