MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6
SHA3-384 hash: 95d4237190b2fa7fcbfcd5a46cb6bedfeac98977b3cd5b7dcf050e0e49c7f734a35e8974ff3cb0fd8a2cad892cdc9d98
SHA1 hash: aab7b678e8c2d25b9730edfe2a69508f0469ff01
MD5 hash: c746cb96ae54457f38290151e3fc9a49
humanhash: stairway-hawaii-charlie-three
File name:weed
Download: download sample
Signature Gafgyt
Create hunting rule
File size:809 bytes
First seen:2025-09-24 16:55:20 UTC
Last seen:2025-09-25 01:15:05 UTC
File type: sh
MIME type:text/plain
ssdeep 12:dZoJ2egeKNWKDbnPZM5ZMoOF7+MB05+X73kX7EDNkPYX78vkX78MDNkPYX7DyTkC:E22IbO5zOt+MB0akPrvmkPykPn
TLSH T15A0104CF00B59C62588A09DB34528D1965CBC5E90ECB8E98A08E547AB8CAD14F372F69
Magika txt
Reporter abuse_ch
Tags:gafgyt sh
URLMalware sample (SHA256 hash)SignatureTags
http://194.31.222.17/a/armv4l85cd0014dcc3d169f6f7ffedf47afba17dd317e3f2ac3dbe2360c4c7599155b0 Gafgytgafgyt mirai opendir
http://194.31.222.17/a/armv5ldbb0c46bbac59891f8f965b0e8f73b85e1f3d2e194631d82495910bea2b567d5 Gafgytgafgyt mirai opendir
http://194.31.222.17/a/armv7l174d918f95f7f37201247f00e514517924860e71194a84f13b352d72a846921f Gafgytgafgyt mirai opendir

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/68d422ac674d5fd6aa0b7082/reports/c94e1c26-6656-477b-a627-a65f40fb1c4d/overview
Verdict:
Malicious
File Type:
ps1
First seen:
2025-09-24T15:07:00Z UTC
Last seen:
2025-09-24T15:07:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a7d2e970-800f-4821-89db-1243cfbaae8a
Behavior Graph:
Download SVG
%3 guuid=629dc40b-1a00-0000-2142-c9abba090000 pid=2490 /usr/bin/sudo guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492 /tmp/sample.bin guuid=629dc40b-1a00-0000-2142-c9abba090000 pid=2490->guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492 execve guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493 clone guuid=b8fcb40f-1a00-0000-2142-c9abc5090000 pid=2501 /usr/bin/rm delete-file guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=b8fcb40f-1a00-0000-2142-c9abc5090000 pid=2501 execve guuid=fc26f90f-1a00-0000-2142-c9abc7090000 pid=2503 /usr/bin/rm delete-file guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=fc26f90f-1a00-0000-2142-c9abc7090000 pid=2503 execve guuid=c8906810-1a00-0000-2142-c9abc9090000 pid=2505 /usr/bin/rm delete-file guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=c8906810-1a00-0000-2142-c9abc9090000 pid=2505 execve guuid=6899b710-1a00-0000-2142-c9abcb090000 pid=2507 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=6899b710-1a00-0000-2142-c9abcb090000 pid=2507 clone guuid=cacf5d12-1a00-0000-2142-c9abd0090000 pid=2512 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=cacf5d12-1a00-0000-2142-c9abd0090000 pid=2512 clone guuid=05eaba12-1a00-0000-2142-c9abd3090000 pid=2515 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=05eaba12-1a00-0000-2142-c9abd3090000 pid=2515 clone guuid=e8412a21-1a00-0000-2142-c9abf4090000 pid=2548 /usr/bin/chmod guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=e8412a21-1a00-0000-2142-c9abf4090000 pid=2548 execve guuid=42e98a21-1a00-0000-2142-c9abf6090000 pid=2550 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=42e98a21-1a00-0000-2142-c9abf6090000 pid=2550 clone guuid=4eff4022-1a00-0000-2142-c9abf9090000 pid=2553 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=4eff4022-1a00-0000-2142-c9abf9090000 pid=2553 clone guuid=bffa392e-1a00-0000-2142-c9ab0f0a0000 pid=2575 /usr/bin/chmod guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=bffa392e-1a00-0000-2142-c9ab0f0a0000 pid=2575 execve guuid=7d8ed22e-1a00-0000-2142-c9ab110a0000 pid=2577 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=7d8ed22e-1a00-0000-2142-c9ab110a0000 pid=2577 clone guuid=61a62731-1a00-0000-2142-c9ab170a0000 pid=2583 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=61a62731-1a00-0000-2142-c9ab170a0000 pid=2583 clone guuid=d58eba3d-1a00-0000-2142-c9ab3c0a0000 pid=2620 /usr/bin/chmod guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=d58eba3d-1a00-0000-2142-c9ab3c0a0000 pid=2620 execve guuid=faf3203e-1a00-0000-2142-c9ab3e0a0000 pid=2622 /usr/bin/dash guuid=9e05a60d-1a00-0000-2142-c9abbc090000 pid=2492->guuid=faf3203e-1a00-0000-2142-c9ab3e0a0000 pid=2622 clone guuid=eabe5e0e-1a00-0000-2142-c9abbe090000 pid=2494 /usr/bin/cat guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493->guuid=eabe5e0e-1a00-0000-2142-c9abbe090000 pid=2494 execve guuid=601b680e-1a00-0000-2142-c9abbf090000 pid=2495 /usr/bin/grep guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493->guuid=601b680e-1a00-0000-2142-c9abbf090000 pid=2495 execve guuid=66a26e0e-1a00-0000-2142-c9abc0090000 pid=2496 /usr/bin/grep guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493->guuid=66a26e0e-1a00-0000-2142-c9abc0090000 pid=2496 execve guuid=4660750e-1a00-0000-2142-c9abc1090000 pid=2497 /usr/bin/grep guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493->guuid=4660750e-1a00-0000-2142-c9abc1090000 pid=2497 execve guuid=504c7f0e-1a00-0000-2142-c9abc2090000 pid=2498 /usr/bin/cut guuid=84d84d0e-1a00-0000-2142-c9abbd090000 pid=2493->guuid=504c7f0e-1a00-0000-2142-c9abc2090000 pid=2498 execve guuid=e298c110-1a00-0000-2142-c9abcc090000 pid=2508 /usr/bin/cp write-file guuid=6899b710-1a00-0000-2142-c9abcb090000 pid=2507->guuid=e298c110-1a00-0000-2142-c9abcc090000 pid=2508 execve guuid=14606612-1a00-0000-2142-c9abd1090000 pid=2513 /usr/bin/chmod guuid=cacf5d12-1a00-0000-2142-c9abd0090000 pid=2512->guuid=14606612-1a00-0000-2142-c9abd1090000 pid=2513 execve guuid=606cc912-1a00-0000-2142-c9abd4090000 pid=2516 /usr/bin/wget net send-data write-file guuid=05eaba12-1a00-0000-2142-c9abd3090000 pid=2515->guuid=606cc912-1a00-0000-2142-c9abd4090000 pid=2516 execve 287749b9-1937-53b1-8818-44b73ae22708 194.31.222.17:80 guuid=606cc912-1a00-0000-2142-c9abd4090000 pid=2516->287749b9-1937-53b1-8818-44b73ae22708 send: 136B guuid=216b4e22-1a00-0000-2142-c9abfa090000 pid=2554 /usr/bin/wget net send-data write-file guuid=4eff4022-1a00-0000-2142-c9abf9090000 pid=2553->guuid=216b4e22-1a00-0000-2142-c9abfa090000 pid=2554 execve guuid=216b4e22-1a00-0000-2142-c9abfa090000 pid=2554->287749b9-1937-53b1-8818-44b73ae22708 send: 136B guuid=b0413431-1a00-0000-2142-c9ab180a0000 pid=2584 /usr/bin/wget net send-data write-file guuid=61a62731-1a00-0000-2142-c9ab170a0000 pid=2583->guuid=b0413431-1a00-0000-2142-c9ab180a0000 pid=2584 execve guuid=b0413431-1a00-0000-2142-c9ab180a0000 pid=2584->287749b9-1937-53b1-8818-44b73ae22708 send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6
Threat name:
Script-Shell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-23 07:16:08 UTC
File Type:
Text (Shell)
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=puxqr2u63gqiifwofkdtwsx6uf4m6kfkvw7krkzidf45op3743ta._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250924-vg29vsbj9s/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 7d2f08ea9ed9a08416ce2a873b4afea178cf28aaadbea8ab281979d73f7fe6e6

(this sample)

Gafgyt

elf 85cd0014dcc3d169f6f7ffedf47afba17dd317e3f2ac3dbe2360c4c7599155b0

  
URLhaus
https://urlhaus.abuse.ch/url/3631142/
  
Delivery method
Distributed via web download
  
Dropping
MD5 094607b91f14001f219a72e9605cccb2
  
Dropping
SHA256 85cd0014dcc3d169f6f7ffedf47afba17dd317e3f2ac3dbe2360c4c7599155b0
  
URLhaus
https://urlhaus.abuse.ch/url/3631168/

Comments