MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gafgyt


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357
SHA3-384 hash: a29a5bfb1811bf38cd7e9992f40978efbf03596a341ed349dd23b93b546685a18255b14e7797c8bddfe14718250c05dc
SHA1 hash: 93fc4307f6cc9edbc577716fdb793a185f60216c
MD5 hash: daca727ccb03c4a48ab398a84e9fae95
humanhash: golf-fourteen-bacon-iowa
File name:exodus.sh
Download: download sample
Signature Gafgyt
Create hunting rule
File size:2'085 bytes
First seen:2026-08-25 05:23:21 UTC
Last seen:2026-08-25 20:50:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vtPP8PJoUjUvUbUDU+aUHUPUyqtUdZUPUTU9rU98n:vtcaUjUvUbUDU+aUHUPUjUdZUPUTUHn
TLSH T1FC414AC7E1A11A3B2E7C97DB336BC82470D1918F44D65F77A8DC3CE4188CE8469A5AC2
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:gafgyt sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.29/m-i.p-s.exodusa0d33b6479506933eebc9068ebdfe96a0300f10ee497f27e9a7225546146a239 Gafgytelf gafgyt mips ua-wget
http://94.154.43.29/m-p.s-l.exodus9cfba2d4c9899c0daa482915cf4f0600e3f67170bcf982cfa458ff878357c7c0 Gafgytelf gafgyt mips ua-wget
http://94.154.43.29/s-h.4-.exodus8417d0598f57edbfde6ee293791c45d4cf8b35cbfb7f9dcf74d2a71651eb34d8 Gafgytelf gafgyt SuperH ua-wget
http://94.154.43.29/x-8.6-.exodus626efd921df91f96474f7627ef3ddcd49d0c1f381758b81cc0da189acd2fd13a Gafgytelf gafgyt ua-wget x86
http://94.154.43.29/a-r.m-6.exodusfe26e6b77f0336cbeee43fec7db2285dde23951a15e04347a83ce9f82b98312b Gafgytarm elf gafgyt ua-wget
http://94.154.43.29/x-3.2-.exodus3854350c9fb279e7fa0b17170300f0944ac5b2b6842136a3e356950f720eb6ee Gafgytelf gafgyt ua-wget x86
http://94.154.43.29/a-r.m-7.exoduseda82e17d94204a01f6639758b86a00a91f317a67735c6056abcca3b4c48c1c2 Gafgytelf gafgyt PowerPC ua-wget
http://94.154.43.29/p-p.c-.exodusa19319febf6b3e9e2ac812f881e8881f5a99d2737066bb57719a43857c229dd5 Gafgytarm elf gafgyt ua-wget
http://94.154.43.29/i-5.8-6.exodus8759e3972a6eef554569f74b7c4ab8e209c8c0ad7598c686cac9861b92264e79 Gafgytelf gafgyt m68k ua-wget
http://94.154.43.29/m-6.8-k.exodusc4cfd50a5e71bc4390bbc44511a0886e54e44775db7d65971fe50acd956e8395 Gafgytarm elf gafgyt ua-wget
http://94.154.43.29/a-r.m-4.exodusa19319febf6b3e9e2ac812f881e8881f5a99d2737066bb57719a43857c229dd5 Gafgytarm elf gafgyt ua-wget
http://94.154.43.29/a-r.m-5.exodus03817cf3d7a3a21186623849a1f63bb068670c6e2dfe32d8fef16d2cb96895e4 Gafgytarm elf gafgyt ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b5033744-36e8-470b-b62e-0c24305cd318
Behavior Graph:
Download SVG
%3 guuid=43ef236c-1b00-0000-0240-c83a17090000 pid=2327 /usr/bin/sudo guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339 /tmp/sample.bin guuid=43ef236c-1b00-0000-0240-c83a17090000 pid=2327->guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339 execve guuid=3be01d74-1b00-0000-0240-c83a28090000 pid=2344 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=3be01d74-1b00-0000-0240-c83a28090000 pid=2344 execve guuid=cce33f7d-1b00-0000-0240-c83a35090000 pid=2357 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=cce33f7d-1b00-0000-0240-c83a35090000 pid=2357 execve guuid=2bdf8b7d-1b00-0000-0240-c83a37090000 pid=2359 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=2bdf8b7d-1b00-0000-0240-c83a37090000 pid=2359 clone guuid=91483b7e-1b00-0000-0240-c83a3a090000 pid=2362 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=91483b7e-1b00-0000-0240-c83a3a090000 pid=2362 execve guuid=a452067f-1b00-0000-0240-c83a3d090000 pid=2365 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=a452067f-1b00-0000-0240-c83a3d090000 pid=2365 execve guuid=a6195685-1b00-0000-0240-c83a48090000 pid=2376 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=a6195685-1b00-0000-0240-c83a48090000 pid=2376 execve guuid=e132d385-1b00-0000-0240-c83a4a090000 pid=2378 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e132d385-1b00-0000-0240-c83a4a090000 pid=2378 clone guuid=09e7f586-1b00-0000-0240-c83a4e090000 pid=2382 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=09e7f586-1b00-0000-0240-c83a4e090000 pid=2382 execve guuid=cff39287-1b00-0000-0240-c83a50090000 pid=2384 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=cff39287-1b00-0000-0240-c83a50090000 pid=2384 execve guuid=2b6e388e-1b00-0000-0240-c83a53090000 pid=2387 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=2b6e388e-1b00-0000-0240-c83a53090000 pid=2387 execve guuid=029fd58e-1b00-0000-0240-c83a54090000 pid=2388 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=029fd58e-1b00-0000-0240-c83a54090000 pid=2388 clone guuid=ec6b8e92-1b00-0000-0240-c83a5b090000 pid=2395 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=ec6b8e92-1b00-0000-0240-c83a5b090000 pid=2395 execve guuid=a74b2e93-1b00-0000-0240-c83a5c090000 pid=2396 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=a74b2e93-1b00-0000-0240-c83a5c090000 pid=2396 execve guuid=e0ef9b99-1b00-0000-0240-c83a65090000 pid=2405 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e0ef9b99-1b00-0000-0240-c83a65090000 pid=2405 execve guuid=e82f2c9a-1b00-0000-0240-c83a67090000 pid=2407 /tmp/x-8.6-.exodus net guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e82f2c9a-1b00-0000-0240-c83a67090000 pid=2407 execve guuid=340ba39a-1b00-0000-0240-c83a6b090000 pid=2411 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=340ba39a-1b00-0000-0240-c83a6b090000 pid=2411 execve guuid=c16a559b-1b00-0000-0240-c83a6d090000 pid=2413 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=c16a559b-1b00-0000-0240-c83a6d090000 pid=2413 execve guuid=4902c7a4-1b00-0000-0240-c83a74090000 pid=2420 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=4902c7a4-1b00-0000-0240-c83a74090000 pid=2420 execve guuid=adadb9a5-1b00-0000-0240-c83a77090000 pid=2423 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=adadb9a5-1b00-0000-0240-c83a77090000 pid=2423 clone guuid=b339afa7-1b00-0000-0240-c83a7c090000 pid=2428 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=b339afa7-1b00-0000-0240-c83a7c090000 pid=2428 execve guuid=4da6dca8-1b00-0000-0240-c83a7e090000 pid=2430 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=4da6dca8-1b00-0000-0240-c83a7e090000 pid=2430 execve guuid=4eba64af-1b00-0000-0240-c83a84090000 pid=2436 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=4eba64af-1b00-0000-0240-c83a84090000 pid=2436 execve guuid=875956b0-1b00-0000-0240-c83a86090000 pid=2438 /tmp/x-3.2-.exodus net guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=875956b0-1b00-0000-0240-c83a86090000 pid=2438 execve guuid=b388d0b1-1b00-0000-0240-c83a8c090000 pid=2444 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=b388d0b1-1b00-0000-0240-c83a8c090000 pid=2444 execve guuid=8f2d59b2-1b00-0000-0240-c83a8e090000 pid=2446 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=8f2d59b2-1b00-0000-0240-c83a8e090000 pid=2446 execve guuid=66c763b9-1b00-0000-0240-c83a94090000 pid=2452 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=66c763b9-1b00-0000-0240-c83a94090000 pid=2452 execve guuid=266adeb9-1b00-0000-0240-c83a96090000 pid=2454 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=266adeb9-1b00-0000-0240-c83a96090000 pid=2454 clone guuid=adcd65bc-1b00-0000-0240-c83a9b090000 pid=2459 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=adcd65bc-1b00-0000-0240-c83a9b090000 pid=2459 execve guuid=bcc8e6bd-1b00-0000-0240-c83a9d090000 pid=2461 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=bcc8e6bd-1b00-0000-0240-c83a9d090000 pid=2461 execve guuid=466039f0-1b00-0000-0240-c83ae5090000 pid=2533 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=466039f0-1b00-0000-0240-c83ae5090000 pid=2533 execve guuid=e15578f1-1b00-0000-0240-c83ae7090000 pid=2535 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e15578f1-1b00-0000-0240-c83ae7090000 pid=2535 clone guuid=8b92d6f3-1b00-0000-0240-c83aeb090000 pid=2539 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=8b92d6f3-1b00-0000-0240-c83aeb090000 pid=2539 execve guuid=8aecc7f5-1b00-0000-0240-c83aee090000 pid=2542 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=8aecc7f5-1b00-0000-0240-c83aee090000 pid=2542 execve guuid=45c15605-1c00-0000-0240-c83a060a0000 pid=2566 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=45c15605-1c00-0000-0240-c83a060a0000 pid=2566 execve guuid=5aff1c06-1c00-0000-0240-c83a090a0000 pid=2569 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=5aff1c06-1c00-0000-0240-c83a090a0000 pid=2569 clone guuid=e685a507-1c00-0000-0240-c83a0e0a0000 pid=2574 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e685a507-1c00-0000-0240-c83a0e0a0000 pid=2574 execve guuid=58627d08-1c00-0000-0240-c83a110a0000 pid=2577 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=58627d08-1c00-0000-0240-c83a110a0000 pid=2577 execve guuid=7bc88c0e-1c00-0000-0240-c83a1b0a0000 pid=2587 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=7bc88c0e-1c00-0000-0240-c83a1b0a0000 pid=2587 execve guuid=1478330f-1c00-0000-0240-c83a1d0a0000 pid=2589 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=1478330f-1c00-0000-0240-c83a1d0a0000 pid=2589 clone guuid=5a30fe0f-1c00-0000-0240-c83a200a0000 pid=2592 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=5a30fe0f-1c00-0000-0240-c83a200a0000 pid=2592 execve guuid=a2499110-1c00-0000-0240-c83a210a0000 pid=2593 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=a2499110-1c00-0000-0240-c83a210a0000 pid=2593 execve guuid=f74d791a-1c00-0000-0240-c83a300a0000 pid=2608 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=f74d791a-1c00-0000-0240-c83a300a0000 pid=2608 execve guuid=acf2561b-1c00-0000-0240-c83a330a0000 pid=2611 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=acf2561b-1c00-0000-0240-c83a330a0000 pid=2611 clone guuid=98d10b1d-1c00-0000-0240-c83a380a0000 pid=2616 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=98d10b1d-1c00-0000-0240-c83a380a0000 pid=2616 execve guuid=03cdb71d-1c00-0000-0240-c83a3a0a0000 pid=2618 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=03cdb71d-1c00-0000-0240-c83a3a0a0000 pid=2618 execve guuid=e5be0f23-1c00-0000-0240-c83a450a0000 pid=2629 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=e5be0f23-1c00-0000-0240-c83a450a0000 pid=2629 execve guuid=88c48323-1c00-0000-0240-c83a470a0000 pid=2631 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=88c48323-1c00-0000-0240-c83a470a0000 pid=2631 clone guuid=160d8524-1c00-0000-0240-c83a4b0a0000 pid=2635 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=160d8524-1c00-0000-0240-c83a4b0a0000 pid=2635 execve guuid=04e31525-1c00-0000-0240-c83a4d0a0000 pid=2637 /usr/bin/wget net send-data write-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=04e31525-1c00-0000-0240-c83a4d0a0000 pid=2637 execve guuid=791cb62a-1c00-0000-0240-c83a590a0000 pid=2649 /usr/bin/chmod guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=791cb62a-1c00-0000-0240-c83a590a0000 pid=2649 execve guuid=16a62b2b-1c00-0000-0240-c83a5b0a0000 pid=2651 /usr/bin/bash guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=16a62b2b-1c00-0000-0240-c83a5b0a0000 pid=2651 clone guuid=0d08102c-1c00-0000-0240-c83a5f0a0000 pid=2655 /usr/bin/rm delete-file guuid=a3bad971-1b00-0000-0240-c83a23090000 pid=2339->guuid=0d08102c-1c00-0000-0240-c83a5f0a0000 pid=2655 execve 5f252486-8cdd-5af6-b3cb-623923d892ec 94.154.43.29:80 guuid=3be01d74-1b00-0000-0240-c83a28090000 pid=2344->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=a452067f-1b00-0000-0240-c83a3d090000 pid=2365->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=cff39287-1b00-0000-0240-c83a50090000 pid=2384->5f252486-8cdd-5af6-b3cb-623923d892ec send: 140B guuid=a74b2e93-1b00-0000-0240-c83a5c090000 pid=2396->5f252486-8cdd-5af6-b3cb-623923d892ec send: 140B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=e82f2c9a-1b00-0000-0240-c83a67090000 pid=2407->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=458f799a-1b00-0000-0240-c83a68090000 pid=2408 /tmp/x-8.6-.exodus guuid=e82f2c9a-1b00-0000-0240-c83a67090000 pid=2407->guuid=458f799a-1b00-0000-0240-c83a68090000 pid=2408 clone guuid=60c2849a-1b00-0000-0240-c83a69090000 pid=2409 /tmp/x-8.6-.exodus net send-data zombie guuid=458f799a-1b00-0000-0240-c83a68090000 pid=2408->guuid=60c2849a-1b00-0000-0240-c83a69090000 pid=2409 clone 1b003392-bb8b-537a-8d6c-7ccb0cfa2400 94.154.43.29:4444 guuid=60c2849a-1b00-0000-0240-c83a69090000 pid=2409->1b003392-bb8b-537a-8d6c-7ccb0cfa2400 send: 65B guuid=c16a559b-1b00-0000-0240-c83a6d090000 pid=2413->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=4da6dca8-1b00-0000-0240-c83a7e090000 pid=2430->5f252486-8cdd-5af6-b3cb-623923d892ec send: 140B guuid=875956b0-1b00-0000-0240-c83a86090000 pid=2438->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1ad6b4b1-1b00-0000-0240-c83a8a090000 pid=2442 /tmp/x-3.2-.exodus guuid=875956b0-1b00-0000-0240-c83a86090000 pid=2438->guuid=1ad6b4b1-1b00-0000-0240-c83a8a090000 pid=2442 clone guuid=0c6dbfb1-1b00-0000-0240-c83a8b090000 pid=2443 /tmp/x-3.2-.exodus net send-data zombie guuid=1ad6b4b1-1b00-0000-0240-c83a8a090000 pid=2442->guuid=0c6dbfb1-1b00-0000-0240-c83a8b090000 pid=2443 clone guuid=0c6dbfb1-1b00-0000-0240-c83a8b090000 pid=2443->1b003392-bb8b-537a-8d6c-7ccb0cfa2400 send: 65B guuid=8f2d59b2-1b00-0000-0240-c83a8e090000 pid=2446->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=bcc8e6bd-1b00-0000-0240-c83a9d090000 pid=2461->5f252486-8cdd-5af6-b3cb-623923d892ec send: 140B guuid=8aecc7f5-1b00-0000-0240-c83aee090000 pid=2542->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=58627d08-1c00-0000-0240-c83a110a0000 pid=2577->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=a2499110-1c00-0000-0240-c83a210a0000 pid=2593->5f252486-8cdd-5af6-b3cb-623923d892ec send: 140B guuid=03cdb71d-1c00-0000-0240-c83a3a0a0000 pid=2618->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B guuid=04e31525-1c00-0000-0240-c83a4d0a0000 pid=2637->5f252486-8cdd-5af6-b3cb-623923d892ec send: 141B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wr5r3tlpf673ksxenm2hbutgpcof6apcvkrwqunpvpt6jstpsnlq._file
Result
Malware family:
gafgyt
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260825-f3svzsxbjb/
Behaviour
Writes file to tmp directory
Reads system network configuration
Reads system routing table
File and Directory Permissions Modification
Executes dropped EXE
Detected Gafgyt variant
Family: Gafgyt/Bashlite
Malware Config
C2 Extraction:
94.154.43.29:4444
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gafgyt

sh b47b1dcd6f2fbfb54ae46b3470d266789c5f01e2aaa36851afabe7e4ca6f9357

(this sample)

Gafgyt

elf a0d33b6479506933eebc9068ebdfe96a0300f10ee497f27e9a7225546146a239

  
URLhaus
https://urlhaus.abuse.ch/url/3907827/
  
Delivery method
Distributed via web download
  
Dropping
MD5 26b96fb2b3dd7568760d351fb1515eb1
  
Dropping
SHA256 a0d33b6479506933eebc9068ebdfe96a0300f10ee497f27e9a7225546146a239

Comments