MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db
SHA3-384 hash:	f7d1bf9e79800f05bc25f811dfa7b9445978396fc7591cd722d14624872bcca00493c325d0c76be9a7d367c2b1f8ac7d
SHA1 hash:	7d9752af7a5fcfd6829ac63db51c59f5c12d88ed
MD5 hash:	79a1e955b057090c4edc21f3f3c59a7b
humanhash:	eleven-asparagus-tennessee-mango
File name:	utt
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'223 bytes
First seen:	2025-07-28 20:22:08 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:sEUSIbK5zOt+MB0hQUQ7k1VOpOmk1VYfk1VDvDgk1VYZ1Hk1VlSkx:sEUXK5CEA0it7k10k1kk1FLgk1eZBk1b
TLSH	T1AC2178CF11918861CC6C9DC9B6934818F4CFDAD935CF8E8CE7CD8526D899E083591F69
Magika	txt
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.51.126.131/t/armv4l	51dbfe5eb3331858e57320a5a2327599fc51d18bab6c76c5d7cb03ca4621078b	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/armv5l	de0a93c843a18ba73b472730753ebd5d796d497f4c0b7533872aadce221f5d80	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/armv7l	e3f59d94764653bbc6887c32ca43edcb670626c10502195d206f308b0684d428	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/powerpc	1564e24be14f2274b7827ef5ac78e442db334fbdf15e73a171dc6cf5186c3741	Gafgyt	elf gafgyt opendir ua-wget
http://158.51.126.131/t/mips	6039ff1c2c6d9a8675c66655fa98c08b461c5ed90b33de19648689c27a7a7756	Gafgyt	elf gafgyt ua-wget
http://158.51.126.131/t/mipsel	48ec5f07842eb9840058755d90325aa23cdd67dca0f23c08faf79ea67918251d	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6887dc1313488cfd44dcdab0/reports/67c32093-32b6-47da-bce2-ae4844c5c7b3/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/604a9da4-b083-483d-82e2-32458d7afeb6

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db/

Verdict:

Malicious

Threat:

HEUR:Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db

Threat name:

Script.Trojan.Malgent

Status:

Malicious

First seen:

2025-07-28 20:25:32 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=phyv4aaaxrjqjkjp5hr4itctlsndzxhgcuwgkg55zbnxdj6gm7nq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250728-y7kdhs1tfw/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/79f15e0000bc5304a92fe9e3c44c535c9a3cdce6152c651bbdc85b71a7c667db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.