MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee
SHA3-384 hash:	213fec80441e5a0e51874bd90892dd023b7d60dde8288e526c48093c585a0467850fbf4334ab95c481d82ec5dce2fbe4
SHA1 hash:	80fd6935b9c256623e9fb0ded884364881a9fc21
MD5 hash:	bf2d72e82bcbf52e17b4d55758cf8dbc
humanhash:	ink-table-crazy-island
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'031 bytes
First seen:	2025-12-13 07:56:31 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:Gn0FnLGUMEe2i0FnLGo2qWYy0FnLR/nsdjIgv0FnLKKNITqLFho0FnLKVwFT+0Fu:1b9FTrGKNIT4hJGVwFT7GC7UN
TLSH	T1D5115B8B90B046715C62B913336A7604BCB190A7B88B5FFFA8E9FAD640CDE74741D543
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.35.154.205/ionetworks.mips	a4cb5422b2a7e49ad24ab4a80a1938fd0989e18d29541389ff6e4d37e40fb296	Gafgyt	elf gafgyt geofenced mips mirai ua-wget USA
http://193.35.154.205/ionetworks.mpsl	fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4	Gafgyt	elf gafgyt geofenced mips mirai ua-wget USA
http://193.35.154.205/ionetworks.x86	0f622b258be87d3f91224168c366b1c5de90af6fdcf941e2d8b72d0ad40cd4a4	Gafgyt	elf gafgyt geofenced mirai ua-wget USA x86
http://193.35.154.205/ionetworks.arm6	13f166bc0c57ed6f23acf5613c8366e0d4cfab1ca97b2689a841d48b9f237a14	Gafgyt	arm elf gafgyt geofenced mirai ua-wget USA
http://193.35.154.205/ionetworks.arm4	bd71a74141ac31ea87ac42c7e6837177422576b35e4c5b940ee5f2725b2a9ba7	Gafgyt	arm elf gafgyt geofenced mirai ua-wget USA
http://193.35.154.205/ionetworks.arm5	d2670dd44eb6690c5f51e500da348566473f84665992d899c816fb66834a9081	Gafgyt	arm elf gafgyt geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive medusa mirai

Link:

https://www.filescan.io/uploads/693d1c5b1eac7b9b76a8a466/reports/16e7205c-1f8b-4c08-a45a-0fe03c2366dc/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-12-13T06:14:00Z UTC

Last seen:

2025-12-14T07:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/332d8656-7159-4ca7-bfcb-fdb55e1dd150

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-12-13 07:51:12 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uiwff4grcqw2d3fby4k67x63vr5ebv3wjtuakf5ih7ay6pyxpdxa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251213-jtd71sdw7f/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.