MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78
SHA3-384 hash:	845e1c48bc7fe057c348943be3a346bc18c881abd7184e569ee8ac61fde3981e29cb5f2618fe475596b8555bc7602ff7
SHA1 hash:	e8d80cf8ea1a42eac7b3317d048597214a5c42ea
MD5 hash:	836ad64dcb0684d7c056045f6ddc86f4
humanhash:	mango-burger-timing-july
File name:	nylexthecat.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'135 bytes
First seen:	2026-02-13 02:08:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ZS+t8Xyb5seAJ+yW8MxMGMTMsoJWoLXWAE:ZS+tjeei+yWPqVosaWoLXWAE
TLSH	T1F041DCCAE5920531FCA4993731AB54483591D59E56CB7F0828DFB4F990DCE4933C2AB3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://bins.herios.st/herios.mips	3dc8788299e43342d65704aa1859523eafb41cf854fde90cb7e414253d429682	Gafgyt	gafgyt
http://bins.herios.st/herios.mipsel	1cecd53eeb10a5a1e94772cd49966335ca01bf43e6bd3f6eaec4be06d0c06368	Mirai	mirai
http://bins.herios.st/herios.sh4	b71589bbacdd564bf09349d4b7475a487ecf6fd75c5f8c2e398512fada364366	Mirai	mirai
http://bins.herios.st/herios.x86	87a5f36fbba03a581c7485a484912ffc36fe4b83480056a82dfd1ba599ad25b6	Mirai	mirai
http://bins.herios.st/herios.arm6	b3267e15c12833a9e9c7895c9743d483b2a8bf81d31e75f45a0fbb790a67d97e	Mirai	mirai
http://bins.herios.st/herios.i686	aaa971931854b38f50527efb2881eaff013404472c18027f7db15894df67537e	Mirai	mirai
http://bins.herios.st/herios.ppc	bbafcb9ee7a6dbd62c8c4e7a05df6cede01f99673e2ad32e827c9dc059d76585	Mirai	mirai
http://bins.herios.st/herios.i586	n/a	n/a	n/a
http://bins.herios.st/herios.m68k	f876a25abd9c0e2b92809fc7bb9fdc263973ed91662193b982fd98bf6709dab1	Mirai	mirai
http://bins.herios.st/herios.sparc	c676ae3810d0420615c1c247b52a22963c2112c0696a30acd5d93b6e01cde3db	Mirai	mirai
http://bins.herios.st/herios.arm4	d3d7def5ebada85b025beda0a8c6f8ee396783df82f0a9ba87dde7c22ba749e1	Mirai	mirai
http://bins.herios.st/herios.arm5	9974f78b57cdd5938f472dfd5af2ed9e8167b1b0b3d33004197003a45db52c09	Mirai	mirai
http://bins.herios.st/herios.arm7	631c566fe97d0673b92610a53049472bf6d8137b04a787f07354fb70ef6caafe	Mirai	mirai
http://bins.herios.st/herios.ppc440	b60eb73f2ef4d1e6a6e8916d6a515e4edb4d61a72d5f6d2002b70bf2ddc28622	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-02-12T23:17:00Z UTC

Last seen:

2026-02-12T23:32:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/18b7e780-e7b9-4f07-a1e2-7c613e5ac7cd

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-13 02:10:12 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tin5jp46zmfdpfjcphpy3aj7hyn43qzkgphrgmddab6al7cnxz4a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260213-ck8xpsgt3a/

Behaviour

System Network Configuration Discovery

File and Directory Permissions Modification

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.97

Link:

https://yomi.yoroi.company/submissions/9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Gafgyt

sh 9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78

(this sample)

Gafgyt

elf 3dc8788299e43342d65704aa1859523eafb41cf854fde90cb7e414253d429682

Dropping

MD5 efeecb9113ea3fc4b171148380a57caf

Dropping

SHA256 3dc8788299e43342d65704aa1859523eafb41cf854fde90cb7e414253d429682

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample