MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37
SHA3-384 hash:	24e12cbb0386fa0f6a1408f31f68a58183fd285b5b5cdeba81c03fb3b991cdb67e2c3ce2e6094ee7580141be83dee6cc
SHA1 hash:	1f40b87c25e16e63f9bfc7d346c5ec6cad347484
MD5 hash:	7d2a2057e15cf2dbea78429e6c051afd
humanhash:	early-triple-blue-delaware
File name:	rondo.aqu.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	9'432 bytes
First seen:	2025-12-24 01:05:26 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:Ax0iRoLngDNtK59KSK/KoKBKaKLKUKS8KfK8KJKzKeCtKubKA2Ko+RKz:g0goLngGUCxM
TLSH	T18012729CF1C002BA2DF94FCA59B3827C890CC5E071E7CDA7DC6448A65AF4948E25D7B9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.231.37.153/rondo.lol	n/a	n/a	ua-wget
http://41.231.37.153/rondo.x86_64	092a91a8ec8d2c719cb214d41f5b4429fa31dbcd29fc698f05d22c97c0f40b0c	Gafgyt	gafgyt RondoDox ua-wget
http://41.231.37.153/rondo.i686	c7a3ceaf8035701817d155ecb7641e2b45beec9f8e1a0de98c0594cd691cc1c7	Mirai	mirai ua-wget
http://41.231.37.153/rondo.i586	a803288d3fc2e95b1fab053a5b3366d2b18c9150e0d509cd2d040ff4e89c0f60	Mirai	mirai ua-wget
http://41.231.37.153/rondo.i486	n/a	n/a	mirai ua-wget
http://41.231.37.153/rondo.armv6l	dfbb2328afd33dbecc280ce7ace009d52bf09a27234751b00ce81c793430f8d5	Mirai	mirai ua-wget
http://41.231.37.153/rondo.armv5l	09b07958c14e7a66150f46a05e4f800de5ebb78dc8741eca4a912fb586bffe3e	RondoDox	mirai RondoDox ua-wget
http://41.231.37.153/rondo.armv4l	89e5e3bf6ac64b76dbb5aedede40c48945fe53668fcd8598b30d61e4e1e52678	Mirai	mirai ua-wget
http://41.231.37.153/rondo.armv7l	7160fb11f12fa2807e46c0a0dbbce833400e96cf8f9ac38658166e52eaf045db	RondoDox	mirai RondoDox ua-wget
http://41.231.37.153/rondo.powerpc	b3c2e428af48e1566f65f8cd675965db94a984ba24ab5e4156e4fd50b7c6488e	Mirai	mirai ua-wget
http://41.231.37.153/rondo.powerpc-440fp	n/a	n/a	mirai RondoDox ua-wget
http://41.231.37.153/rondo.mips	4ec35dd2c9c25e17dfc469e1017f39b874720a74bd820488ba7607a742371c0b	Gafgyt	gafgyt ua-wget
http://41.231.37.153/rondo.mipsel	3e0d08d6710ca0296e0bec1385dc76dba9de819e65e17dde7ebeb8eb15fd08da	Gafgyt	gafgyt ua-wget
http://41.231.37.153/rondo.arc700	eba7f55fd909e5a43c09765848af3e7516844a3921641a96be6caa32f74bd2b4	Mirai	mirai ua-wget
http://41.231.37.153/rondo.sh4	07f235bd2f413e3717c177ee8c55b159d98499d42005f9136ddfd6085f93e796	Mirai	mirai ua-wget
http://41.231.37.153/rondo.sparc	cd69fc3faa8bfadd257a93ac2b25b41fe04f240173059456e870ea82838a571d	Mirai	mirai ua-wget
http://41.231.37.153/rondo.m68k	0e571eaa740bcbb03d1d7d93df6630cbcedaedd0c3bdeabdf4df6f54fdacc248	Mirai	mirai ua-wget
http://41.231.37.153/rondo.armeb	n/a	n/a	RondoDox ua-wget
http://41.231.37.153/rondo.armebhf	n/a	n/a	ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

URLhaus.3736093.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox masquerade

Link:

https://www.filescan.io/uploads/694b3c89e126b9ff438f2928/reports/49a78952-6c90-4ddc-82f6-b93c4c03a9ec/overview

Result

Gathering data

Verdict:

Clean

File Type:

unix shell

Link:

https://opentip.kaspersky.com/950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e09c6a67-6108-4c28-90cc-22f7a24e023c

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-12-24 01:06:17 UTC

File Type:

Text (Shell)

AV detection:

3 of 36 (8.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sucbtwtmg7c7v72ferl42c3vtooniutm5bkowolmgtvnpqw6p43q._file

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/950419da6c37c5faff452457cd0b759b9cd4526ce854eb396c34ead7c2de7f37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh