MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a
SHA3-384 hash:	b64113e61acf297e014b64f314bcc3bf7d64c5b618f8adcd91fbc44dd53bad35b326858d2bcfb74522451c306683042d
SHA1 hash:	5bdd2e936efc3eb802f46944d032db8fec282172
MD5 hash:	4f9c91192dc8b3f18e974bb4264f47a6
humanhash:	sierra-black-sweet-hot
File name:	handshakebins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	7'363 bytes
First seen:	2026-10-06 14:27:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:G9VQstFrZhVoKxJpiWKyKEWl8fNtgaWKxS/FTl81ciKxc4ECl89:D3DBl8gP7Tl81hnCl89
TLSH	T148E1D6DB229719716DE0F81B72BA480470D5A19F40F66F856EEC38F891CDD8CE4A0AD3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.232.114.14/nokillbins/telnetd	d58ed4e7cf9ab3181cb59e18050cd9d4c41b334f0f07be08abe5bafed5c04069	Mirai	gafgyt mirai wraith
http://213.232.114.14/nokillbins/telnet	5003d4cf1849fc207f3023b7220800f998cc34ec416ca3525f2707711258b98a	Mirai	gafgyt mirai wraith
http://213.232.114.14/nokillbins/kworker	3e724458a4b817aad81a70746f397fc4830da3ab02d465f53dcf8e6af9a8391e	Mirai	gafgyt mirai wraith
http://213.232.114.14/nokillbins/sshd	627f383e146ccc663d2d88a6b765330b181bf0b197ccc4510540d283e41a5704	Mirai	elf gafgyt mirai ua-wget
http://213.232.114.14/nokillbins/bash	8f257396b6c3472702d7562d6e5ac4b869de4039954db5991139ca5ae00de30a	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/getty	34ae6b0ab55c1caf55b556cc3f0a85af03586fa7861a64112a49a7258d69709f	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/kernal	d32393f0c64660baab8974eda993fff837c24a3ec296bbfc302a4f6e3a5a305b	Mirai	elf gafgyt mirai ua-wget
http://213.232.114.14/nokillbins/gnome	56c17e283d9349a7d46a01f52ee8d4892d69e57cb722e9dab01f771aa2bf6783	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/ntp	79470e722fcc76b61df510b3053dc645bdd7715ff719dbfab79e4f51511f278f	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/ext4	775f9ff2d3638bebe23f14dc3ad99385f0fbd9186322c6309b27f0104c22aa6e	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/watchdogd	09e9d8b33d642f842776f533c84c8babf7b0af0c5fbdf64d01fad282b5556a7f	Mirai	elf gafgyt mirai ua-wget
http://213.232.114.14/nokillbins/systemd	9f04d8622216750884fe7779ea833b37f1c1670a88dc88041a5cbf695bc2dd31	Mirai	elf gafgyt mirai ua-wget
http://213.232.114.14/nokillbins/ntpd	92baf27a7e12492afc234d50e29c72be684defba325af23e5c4412c1277b4601	Mirai	elf mirai ua-wget
http://213.232.114.14/nokillbins/login	n/a	n/a	elf ua-wget
http://213.232.114.14/nokillbins/dbus	n/a	n/a	elf ua-wget
http://213.232.114.14/nokillbins/kde	n/a	n/a	elf ua-wget
http://213.232.114.14/nokillbins/crypto	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Sanesecurity.Malware.31067.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-06T12:39:00Z UTC

Last seen:

2026-10-07T21:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/072931bf-0b12-43ed-a414-fe93ba794837

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-10-06 14:28:19 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w2kntruuc77ikfhsvoaop5z26ghamu6ko5he5mkmosrxoxljzrfa._file

Result

Malware family:

gafgyt

Score:

10/10

Tags:

family:gafgyt antivm botnet defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/261006-rs4ehshx6w/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Reads system network configuration

Modifies Bash startup script

Creates a large amount of network flows

Creates/modifies Cron job

Creates/modifies environment variables

Enumerates running processes

Modifies init.d

Modifies rc script

Modifies systemd

Reads system routing table

Schedules an At job

File and Directory Permissions Modification

Executes dropped EXE

Detected Gafgyt variant

Family: Gafgyt/Bashlite

Malware Config

C2 Extraction:

64.89.161.96:55487

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b694d9c69417/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b694d9c69417fe8514f2ab80e7f73af18e0653ca774e4eb14c74a3775d69cc4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Sample_Unique_586960df Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	586960df8bf559ffbba600f11917a99baed4a875cb7faa5eabc060bcde67277b.sh