MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183
SHA3-384 hash:	67416f3b10ad7c726985e446a697c316d33b9d5674e241448061896fd1008769a5a1329c7a1badf6807c94fc6317a49e
SHA1 hash:	1428371d2ae43393214af55086db4d5a826944f2
MD5 hash:	828af7ccd5a52317480d1c503209047b
humanhash:	idaho-wyoming-six-carbon
File name:	t.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	2'611 bytes
First seen:	2025-07-31 17:17:41 UTC
Last seen:	2025-08-01 01:35:27 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:IEArKv+Ud/hAcrgckZ/rC3qjG/7IuuB3B9/YrBXpa3VgBfBTAcHBB06BMx7k7dLU:IEAGvvecrgj+qydOx9IXJkcHv0qMK7JU
TLSH	T1EB51125FB0C46F7018159054AD9FB38966914D1B8D043C15B42C27A86F366F8AFFE753
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

28

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm anti-vm base64 fingerprint

Link:

https://www.filescan.io/uploads/688ba55fdc44c87d077977f4/reports/dca15eee-7da4-4605-94fb-14335fabf3ed/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/092cfd6a-f0e3-4d61-ac06-08f28ab82cbc

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183

ReversingLabs TitaniumCloud Linux.Trojan.Gafgyt

Threat name:

Linux.Trojan.Gafgyt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-31 17:18:22 UTC

File Type:

Text (Shell)

AV detection:

2 of 38 (5.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vdqwtivvglplvlzi6o6zqlda44a3odvuwv7rehe7mcqrnmpusgbq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/250731-vveqqaypw2/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Looks up external IP address via web service

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/a8e169a2b532debaaf28f3bd982c60e701b70eb4b57f121c9f60a116b1f49183