MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a327a348f3d8f0816eebf65f99d89ccff2113766de8fcd5c474e9346a54ad998. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a327a348f3d8f0816eebf65f99d89ccff2113766de8fcd5c474e9346a54ad998
SHA3-384 hash:	a36e421d5916db73d5a09876426537e700358f97c04e71be69bad2877152d412040d891fc398cbbeb48546306fb2f737
SHA1 hash:	b379ef4b50a38ca104121e7cd3f65602330934c7
MD5 hash:	7f5ac31d8cd0fefde65006edc23cfff7
humanhash:	double-emma-king-king
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'923 bytes
First seen:	2025-03-15 00:16:15 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:14ERchNItslwPsi1+bzsFVgLPonnU843UJKI:14gc4slwPsi1+Xs0PonnU843UJx
TLSH	T13841A5CE91A306797E60EE2731AC4B00BEC6E09A67D6EF64FCDC34E5048DE14E044697
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://37.44.238.66/gigab.arm4	d45704703c155f503ba8f34d39cfdc7e329a2b534afd9982678b8755fb89f0ba	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.arm4t	48d3cf463eae240eeadde8b2decc1c463b6806ca0fb6f731825aaf65b2d7efcc	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.arm5	bcbd01dd5248b182980e05464c8df951b5bf234d63864355b466994cff2d6395	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.arm6	a5a46fbf916e739d774d4d69d603e55d7ae287d68b37f1c9485f04f07dbc4962	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.i686	ba5576afa931b157691a9d1eaf9cd7cf2bc933613d369a2ec223e29e221298e7	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.m68	d5290c6e1d1376765f1395697b2a1b65d79a33bd64ac4c4cf902a2407665431a	Mirai	elf gafgyt mirai
http://37.44.238.66/gigab.mips	n/a	n/a	elf gafgyt
http://37.44.238.66/gigab.mpsl	b07a492a30c2d349c9f0efa3f3aebdd185e7fa5892dc0fa10883b2723cb906c8	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.ppc	c683cb18a356dd0b80c0c2b493424f3db4cb6b60f4ec4af776fc3a99b157567e	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.spc	372e8813b3438cfbe7476e32474dc893a4fd5366af52220c0e7b450c51df48b9	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.x86	f2ee8037f1080c9950a2cc5872f387fa4183d35822f3b590650122d186fe3784	Gafgyt	elf gafgyt
http://37.44.238.66/gigab.sh4	cfc69d3b906d9a164fa4fbf17eab76309e481d67ac7c150fda7787897332a1e1	Mirai	elf gafgyt mirai
http://37.44.238.66/gigab.arm7	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d4d56d3962f1a6f4716dcblinux22vpnfull_triage

Tags:

downloader trojan agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin mirai remote

Link:

https://www.filescan.io/uploads/67d4c70a01edd28374b056cd/reports/0fb9fbe3-64bc-4ee4-b3e0-ae46bbd70c63/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a327a348f3d8f0816eebf65f99d89ccff2113766de8fcd5c474e9346a54ad998

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a327a348f3d8f0816eebf65f99d89ccff2113766de8fcd5c474e9346a54ad998/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-03-15 00:17:15 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=umt2gsht3dyic3xl6zpztwe4z7zbcn3g32h42xchj2junjkk3gma._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250315-ak4lwa1zcw/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a327a348f3d8f0816eebf65f99d89ccff2113766de8fcd5c474e9346a54ad998

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.