MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea
SHA3-384 hash: 906b881baac21c1a1e74c230c0499d224a4918e9a7e6baacb9ea872f9e7a82f4cbc2ac2c3957e64d56cb4d38eec6844d
SHA1 hash: 5b4368c7cff37e13bb289df4956592d34cbb3931
MD5 hash: 05cd451ba4be2d15445583e5dbbeecd5
humanhash: single-august-twelve-william
File name:SnOoPy.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:2'085 bytes
First seen:2026-04-05 07:17:22 UTC
Last seen:2026-04-06 04:36:28 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:vGkAhGr0dSxG7GBpogG/G7TGjGvjGm8GosGvjG3GY:vDAh+ymVeeTqy589sy+1
TLSH T18241589AF19159F06DA4D81333F9944031D4A0CEA9C6AF1F28DFBBE9488DDC82A04697
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:gafgyt sh
URLMalware sample (SHA256 hash)SignatureTags
http://87.121.79.97/m-i.p-s.SNOOPYac71bff9f7a03dcb5433406bd9a885952a950e9b7be3cc657a72044944e22984 Gafgytelf gafgyt ua-wget
http://87.121.79.97/m-p.s-l.SNOOPY90f119b97617ad837c0e454bbda21ba9e59db89d79d74ac798783334a892f764 Gafgytelf gafgyt ua-wget
http://87.121.79.97/s-h.4-.SNOOPYf3416c68120458b92d4fda0a058ed05864123192d84e5a8fe1b8719991665329 Gafgytelf gafgyt ua-wget
http://87.121.79.97/x-8.6-.SNOOPY1a6603e91b01c18b7e4b61d911015d2376c6e2a01167cea85a181de42f95a2c5 Gafgytelf gafgyt ua-wget
http://87.121.79.97/a-r.m-6.SNOOPYf8a3602dfcad45d46d1e66d7b81cd7c08e860a095ad475136ec8836808a5a33b Gafgytelf gafgyt ua-wget
http://87.121.79.97/x-3.2-.SNOOPYe7bf55498b8872a76194a0fe983d0b2ab8506b1b06d69ad2d274a8ccdfde0943 Gafgytelf gafgyt ua-wget
http://87.121.79.97/a-r.m-7.SNOOPYab70622e1386e2a04fb7c691e765d331b32620a298fbdc2ee6653f577dac76ef Gafgytelf gafgyt ua-wget
http://87.121.79.97/p-p.c-.SNOOPY5b44583dc55181a7da206710553122310b4bd1f9139dba774c7b584b22f4b1d3 Gafgytelf gafgyt ua-wget
http://87.121.79.97/i-5.8-6.SNOOPYe642ebc2e65906c162c0995c0bb1a87cd21afae3dc2eef1a372ef62d116426a6 Gafgytelf gafgyt ua-wget
http://87.121.79.97/m-6.8-k.SNOOPY93858d7740e79ef1196d640f90543e40ee8b3ebfde18f2d0c67331bd46cadf38 Gafgytelf gafgyt ua-wget
http://87.121.79.97/a-r.m-4.SNOOPYaf5fcce04c3955e705f132a7a9b384a0f4abe2d7f92aaec3330abb18ab70c6b1 Gafgytelf gafgyt ua-wget
http://87.121.79.97/a-r.m-5.SNOOPYn/an/acensys elf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-04-05T04:24:00Z UTC
Last seen:
2026-04-07T02:06:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/396c4558-fc3d-40d9-84b0-0d304595c127
Behavior Graph:
Download SVG
%3 guuid=1885cf87-1a00-0000-1809-e32aa4090000 pid=2468 /usr/bin/sudo guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474 /tmp/sample.bin guuid=1885cf87-1a00-0000-1809-e32aa4090000 pid=2468->guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474 execve guuid=d107aa8a-1a00-0000-1809-e32aac090000 pid=2476 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=d107aa8a-1a00-0000-1809-e32aac090000 pid=2476 execve guuid=93296891-1a00-0000-1809-e32ab3090000 pid=2483 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=93296891-1a00-0000-1809-e32ab3090000 pid=2483 execve guuid=8d72d591-1a00-0000-1809-e32ab5090000 pid=2485 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=8d72d591-1a00-0000-1809-e32ab5090000 pid=2485 clone guuid=e9841293-1a00-0000-1809-e32aba090000 pid=2490 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=e9841293-1a00-0000-1809-e32aba090000 pid=2490 execve guuid=908c9393-1a00-0000-1809-e32abc090000 pid=2492 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=908c9393-1a00-0000-1809-e32abc090000 pid=2492 execve guuid=22446699-1a00-0000-1809-e32ac3090000 pid=2499 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=22446699-1a00-0000-1809-e32ac3090000 pid=2499 execve guuid=5d03ae99-1a00-0000-1809-e32ac4090000 pid=2500 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=5d03ae99-1a00-0000-1809-e32ac4090000 pid=2500 clone guuid=43ba619a-1a00-0000-1809-e32ac6090000 pid=2502 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=43ba619a-1a00-0000-1809-e32ac6090000 pid=2502 execve guuid=e0b8eb9a-1a00-0000-1809-e32ac7090000 pid=2503 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=e0b8eb9a-1a00-0000-1809-e32ac7090000 pid=2503 execve guuid=97cbaea0-1a00-0000-1809-e32ad3090000 pid=2515 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=97cbaea0-1a00-0000-1809-e32ad3090000 pid=2515 execve guuid=7a1122a1-1a00-0000-1809-e32ad4090000 pid=2516 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=7a1122a1-1a00-0000-1809-e32ad4090000 pid=2516 clone guuid=4041c2a1-1a00-0000-1809-e32ad7090000 pid=2519 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=4041c2a1-1a00-0000-1809-e32ad7090000 pid=2519 execve guuid=37e15fa2-1a00-0000-1809-e32ad8090000 pid=2520 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=37e15fa2-1a00-0000-1809-e32ad8090000 pid=2520 execve guuid=35e28ea7-1a00-0000-1809-e32ae4090000 pid=2532 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=35e28ea7-1a00-0000-1809-e32ae4090000 pid=2532 execve guuid=d847fba7-1a00-0000-1809-e32ae6090000 pid=2534 /tmp/x-8.6-.SNOOPY net guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=d847fba7-1a00-0000-1809-e32ae6090000 pid=2534 execve guuid=e49167a8-1a00-0000-1809-e32aea090000 pid=2538 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=e49167a8-1a00-0000-1809-e32aea090000 pid=2538 execve guuid=2d420ea9-1a00-0000-1809-e32aec090000 pid=2540 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=2d420ea9-1a00-0000-1809-e32aec090000 pid=2540 execve guuid=e204bdae-1a00-0000-1809-e32af6090000 pid=2550 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=e204bdae-1a00-0000-1809-e32af6090000 pid=2550 execve guuid=03b418af-1a00-0000-1809-e32af8090000 pid=2552 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=03b418af-1a00-0000-1809-e32af8090000 pid=2552 clone guuid=25bfa3b0-1a00-0000-1809-e32afe090000 pid=2558 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=25bfa3b0-1a00-0000-1809-e32afe090000 pid=2558 execve guuid=58fc0cb1-1a00-0000-1809-e32a000a0000 pid=2560 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=58fc0cb1-1a00-0000-1809-e32a000a0000 pid=2560 execve guuid=dcca96b5-1a00-0000-1809-e32a050a0000 pid=2565 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=dcca96b5-1a00-0000-1809-e32a050a0000 pid=2565 execve guuid=5d7debb5-1a00-0000-1809-e32a060a0000 pid=2566 /tmp/x-3.2-.SNOOPY net guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=5d7debb5-1a00-0000-1809-e32a060a0000 pid=2566 execve guuid=74d405b7-1a00-0000-1809-e32a0b0a0000 pid=2571 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=74d405b7-1a00-0000-1809-e32a0b0a0000 pid=2571 execve guuid=8f8d94b7-1a00-0000-1809-e32a0e0a0000 pid=2574 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=8f8d94b7-1a00-0000-1809-e32a0e0a0000 pid=2574 execve guuid=14f368be-1a00-0000-1809-e32a200a0000 pid=2592 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=14f368be-1a00-0000-1809-e32a200a0000 pid=2592 execve guuid=0d12cdbe-1a00-0000-1809-e32a210a0000 pid=2593 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=0d12cdbe-1a00-0000-1809-e32a210a0000 pid=2593 clone guuid=921c72c0-1a00-0000-1809-e32a280a0000 pid=2600 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=921c72c0-1a00-0000-1809-e32a280a0000 pid=2600 execve guuid=4769dec0-1a00-0000-1809-e32a2a0a0000 pid=2602 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=4769dec0-1a00-0000-1809-e32a2a0a0000 pid=2602 execve guuid=ef156cc5-1a00-0000-1809-e32a360a0000 pid=2614 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=ef156cc5-1a00-0000-1809-e32a360a0000 pid=2614 execve guuid=1e00d9c5-1a00-0000-1809-e32a390a0000 pid=2617 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=1e00d9c5-1a00-0000-1809-e32a390a0000 pid=2617 clone guuid=016bb5c6-1a00-0000-1809-e32a3d0a0000 pid=2621 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=016bb5c6-1a00-0000-1809-e32a3d0a0000 pid=2621 execve guuid=0af226c7-1a00-0000-1809-e32a3f0a0000 pid=2623 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=0af226c7-1a00-0000-1809-e32a3f0a0000 pid=2623 execve guuid=3adc43cb-1a00-0000-1809-e32a4b0a0000 pid=2635 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=3adc43cb-1a00-0000-1809-e32a4b0a0000 pid=2635 execve guuid=63f1b1cb-1a00-0000-1809-e32a4d0a0000 pid=2637 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=63f1b1cb-1a00-0000-1809-e32a4d0a0000 pid=2637 clone guuid=96e6a4cc-1a00-0000-1809-e32a510a0000 pid=2641 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=96e6a4cc-1a00-0000-1809-e32a510a0000 pid=2641 execve guuid=16661ecd-1a00-0000-1809-e32a540a0000 pid=2644 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=16661ecd-1a00-0000-1809-e32a540a0000 pid=2644 execve guuid=63f14ad2-1a00-0000-1809-e32a620a0000 pid=2658 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=63f14ad2-1a00-0000-1809-e32a620a0000 pid=2658 execve guuid=1050add2-1a00-0000-1809-e32a640a0000 pid=2660 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=1050add2-1a00-0000-1809-e32a640a0000 pid=2660 clone guuid=b1ba59d3-1a00-0000-1809-e32a680a0000 pid=2664 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=b1ba59d3-1a00-0000-1809-e32a680a0000 pid=2664 execve guuid=ed06add3-1a00-0000-1809-e32a6a0a0000 pid=2666 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=ed06add3-1a00-0000-1809-e32a6a0a0000 pid=2666 execve guuid=75534bd9-1a00-0000-1809-e32a7a0a0000 pid=2682 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=75534bd9-1a00-0000-1809-e32a7a0a0000 pid=2682 execve guuid=3b7297d9-1a00-0000-1809-e32a7b0a0000 pid=2683 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=3b7297d9-1a00-0000-1809-e32a7b0a0000 pid=2683 clone guuid=b41e78db-1a00-0000-1809-e32a820a0000 pid=2690 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=b41e78db-1a00-0000-1809-e32a820a0000 pid=2690 execve guuid=2be4eadb-1a00-0000-1809-e32a850a0000 pid=2693 /usr/bin/wget net send-data write-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=2be4eadb-1a00-0000-1809-e32a850a0000 pid=2693 execve guuid=42e619e0-1a00-0000-1809-e32a900a0000 pid=2704 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=42e619e0-1a00-0000-1809-e32a900a0000 pid=2704 execve guuid=ca3981e0-1a00-0000-1809-e32a930a0000 pid=2707 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=ca3981e0-1a00-0000-1809-e32a930a0000 pid=2707 clone guuid=f64059e1-1a00-0000-1809-e32a970a0000 pid=2711 /usr/bin/rm delete-file guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=f64059e1-1a00-0000-1809-e32a970a0000 pid=2711 execve guuid=c77abfe1-1a00-0000-1809-e32a990a0000 pid=2713 /usr/bin/wget net send-data guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=c77abfe1-1a00-0000-1809-e32a990a0000 pid=2713 execve guuid=f2e484e4-1a00-0000-1809-e32aa10a0000 pid=2721 /usr/bin/chmod guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=f2e484e4-1a00-0000-1809-e32aa10a0000 pid=2721 execve guuid=1ae3dbe4-1a00-0000-1809-e32aa30a0000 pid=2723 /usr/bin/bash guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=1ae3dbe4-1a00-0000-1809-e32aa30a0000 pid=2723 clone guuid=2962f9e4-1a00-0000-1809-e32aa40a0000 pid=2724 /usr/bin/rm guuid=73c1448a-1a00-0000-1809-e32aaa090000 pid=2474->guuid=2962f9e4-1a00-0000-1809-e32aa40a0000 pid=2724 execve 6c9b90f8-2925-5ba9-bce8-ce701ae330e4 87.121.79.97:80 guuid=d107aa8a-1a00-0000-1809-e32aac090000 pid=2476->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=908c9393-1a00-0000-1809-e32abc090000 pid=2492->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=e0b8eb9a-1a00-0000-1809-e32ac7090000 pid=2503->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 140B guuid=37e15fa2-1a00-0000-1809-e32ad8090000 pid=2520->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 140B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=d847fba7-1a00-0000-1809-e32ae6090000 pid=2534->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ab0239a8-1a00-0000-1809-e32ae7090000 pid=2535 /tmp/x-8.6-.SNOOPY guuid=d847fba7-1a00-0000-1809-e32ae6090000 pid=2534->guuid=ab0239a8-1a00-0000-1809-e32ae7090000 pid=2535 clone guuid=c8593fa8-1a00-0000-1809-e32ae8090000 pid=2536 /tmp/x-8.6-.SNOOPY net send-data zombie guuid=ab0239a8-1a00-0000-1809-e32ae7090000 pid=2535->guuid=c8593fa8-1a00-0000-1809-e32ae8090000 pid=2536 clone c72408b0-318d-5183-9456-0699c3252aa8 87.121.79.97:999 guuid=c8593fa8-1a00-0000-1809-e32ae8090000 pid=2536->c72408b0-318d-5183-9456-0699c3252aa8 send: 107B guuid=2d420ea9-1a00-0000-1809-e32aec090000 pid=2540->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=58fc0cb1-1a00-0000-1809-e32a000a0000 pid=2560->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 140B guuid=5d7debb5-1a00-0000-1809-e32a060a0000 pid=2566->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d850f0b6-1a00-0000-1809-e32a090a0000 pid=2569 /tmp/x-3.2-.SNOOPY guuid=5d7debb5-1a00-0000-1809-e32a060a0000 pid=2566->guuid=d850f0b6-1a00-0000-1809-e32a090a0000 pid=2569 clone guuid=b79bf6b6-1a00-0000-1809-e32a0a0a0000 pid=2570 /tmp/x-3.2-.SNOOPY net send-data zombie guuid=d850f0b6-1a00-0000-1809-e32a090a0000 pid=2569->guuid=b79bf6b6-1a00-0000-1809-e32a0a0a0000 pid=2570 clone guuid=b79bf6b6-1a00-0000-1809-e32a0a0a0000 pid=2570->c72408b0-318d-5183-9456-0699c3252aa8 send: 107B guuid=8f8d94b7-1a00-0000-1809-e32a0e0a0000 pid=2574->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=4769dec0-1a00-0000-1809-e32a2a0a0000 pid=2602->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 140B guuid=0af226c7-1a00-0000-1809-e32a3f0a0000 pid=2623->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=16661ecd-1a00-0000-1809-e32a540a0000 pid=2644->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=ed06add3-1a00-0000-1809-e32a6a0a0000 pid=2666->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 140B guuid=2be4eadb-1a00-0000-1809-e32a850a0000 pid=2693->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B guuid=c77abfe1-1a00-0000-1809-e32a990a0000 pid=2713->6c9b90f8-2925-5ba9-bce8-ce701ae330e4 send: 141B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea/
Verdict:
Malicious
Threat:
Family.GAFGYT
Link:
https://tip.neiki.dev/file/8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-04-05 07:18:51 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkaldwglnxn5q3p76w6klpc2sxpukand2km5orqpctj4zh5fehva._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260405-h45bhsgt5t/
Behaviour
Writes file to tmp directory
Reads system network configuration
Reads system routing table
File and Directory Permissions Modification
Executes dropped EXE
Detected Gafgyt variant
Gafgyt family
Gafgyt/Bashlite
Malware Config
C2 Extraction:
87.121.79.97:999
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh 8a80b1d8cb6ddbd86dfff5bca5bc5a95df4501a3d299d7460f14d3cc9fa521ea

(this sample)

Gafgyt

elf ac71bff9f7a03dcb5433406bd9a885952a950e9b7be3cc657a72044944e22984

  
URLhaus
https://urlhaus.abuse.ch/url/3812304/
  
Delivery method
Distributed via web download
  
Dropping
MD5 f7fe73b8f8a1d306e6d61b9826a66faf
  
Dropping
SHA256 ac71bff9f7a03dcb5433406bd9a885952a950e9b7be3cc657a72044944e22984

Comments