MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96
SHA3-384 hash:	dc04d4209d0953d7ea2269326ecb96a3bc52d124eed2965931fe65ad4b0bc826b82ce42f03517a9c046cfad5dce32c06
SHA1 hash:	f828dfea3f0423d99c08be675743babcd65fec5d
MD5 hash:	3bafe7221973af87cec1140e7f7f97de
humanhash:	xray-white-music-pizza
File name:	sex.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'600 bytes
First seen:	2025-09-18 05:14:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0F1V0FD0Fbc43fX0F3AeekX0FKq0FW+X0FNOe0FHfX0Faq0Fhl0FhaM0FpWK0F/:v1+Abc4kwasKvvsNOb/savhOhaFpK/
TLSH	T1423193CA32A509747CA0E96732BE994532D8E5CB50DE2F492EEE38F9418EE0870007D7
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://205.185.121.141/mips	c1083f406437651d99f4b0a6fdbb3dc57f7268fc3c1f071b8330007ca9f36de6	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/mipsel	bcc239c8ac93b5b198fd4c5be8da9a252ef9149fcc3c13986d364826a9c8d900	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/sh4	e6e0d5334a6b305ecb60f563aa16cb5d47ffa420a03799c030ac51d3ab869ff3	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/x86	962c7912c44af279cd7879402913ca17968a64788b041b855867d42bf0441387	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/arm61	e4393a49350ed5e410e1cf286c4b8b6df29224348c9972aadcded5cb74874fba	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/i686	5bb6b335d5df8e953dafe382ef810d5629fa15f959655c1fcbe2af815ad4bb13	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/ppc	995e632e29a9c2635cfc9f693950e3ad07ae18028968e1427b306bb72e573a00	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/586	a33aa07b8f51e7bfee450b08b563fb72d93834f9955ad189795a49532f3cce97	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/m68k	684668d3065daad253570100f3b947a50aad9be3e4429d02c156176899e23e60	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/dc	n/a	n/a	elf ua-wget
http://205.185.121.141/dss	729fdb587dd9b93b8d689209d68b2ef32678cb3263177d79e443046fb278c93c	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/co	cf9a897fadec97206fe1f75f6978a04c333d37ac418fc1525bcabe3f13f225a0	Gafgyt	elf gafgyt ua-wget
http://205.185.121.141/scar	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-17T18:18:00Z UTC

Last seen:

2025-09-17T18:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d21570fe-52ac-47f3-b1c2-4f7e55673764

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96/

Verdict:

Malicious

Threat:

Family.GAFGYT

Link:

https://tip.neiki.dev/file/9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-09-18 00:24:42 UTC

File Type:

Text (Shell)

AV detection:

24 of 37 (64.86%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sykmp7hmkuhplnmvgbdzdxxabtunx27u3bw2bl4wfnl4fmafxola._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250918-fx7f7aap4w/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

Malware Config

C2 Extraction:

205.185.121.141:23

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/9614c7fcec550ef5b595304791dee00ce8dbebf4d86da0af962b57c2b005bb96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.