MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b76fa6a99a421264c0c6f2fd4d300adc100fe552cb6b0db4e2d995e0b2197fbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	b76fa6a99a421264c0c6f2fd4d300adc100fe552cb6b0db4e2d995e0b2197fbc
SHA3-384 hash:	52f52146c25ecbf7b8321b91aa70254aa121db98a332922483750689af88d9fe655ebaf11594214dcc2fb30cff70ad82
SHA1 hash:	5c46ecd24dba1c3c4550eb4ab711e165b0977f2a
MD5 hash:	9a50f0761e6cb43c48a4e854accaffb7
humanhash:	lima-ohio-pluto-chicken
File name:	snypesh.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	2'856 bytes
First seen:	2026-10-11 23:48:34 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v3c3GaCUdm3I3k3g3Q3Na3M343I3W33Y3M343U3A32t3fla3f:v3c3GLUdm3I3k3g3Q3I3M343I3E3Y3M0
TLSH	T132513DCA13AA057BAD92DAA33369840E71D4E5E71DC6AF8469EC34FB449DD04301E7C3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.198.224.34/snype.mips	ea81e8b74d24f72a4020c4847419fe61c6c13393287356980f70d1ab212116c7	Gafgyt	elf
http://45.198.224.34/snype.mpsl	803019eb9738e9a702164b59072de81e29598371e73b80e3c4d6c9adf2041275	Gafgyt	elf
http://45.198.224.34/snype.mipsel	803019eb9738e9a702164b59072de81e29598371e73b80e3c4d6c9adf2041275	Gafgyt	n/a
http://45.198.224.34/snype.x86	d81d9de5d82bca654f4148fa7634707623c39573242650fae2bf32d4b7b4591b	Gafgyt	elf
http://45.198.224.34/snype.ppc	379d762e3da04fd773ffc5d60fcd3128bed3246e85899994a42bdae96d1c3733	Gafgyt	elf
http://45.198.224.34/snype.sparc	4a514dae05f134a50d117942e41ee81aa55b7eb2d9b99955f37dc75c5d0dea37	Mirai	n/a
http://45.198.224.34/snype.arm4	1388bde12ececcf57506a1ab5f8bade4afdaed438dd5a6a18e763236ba623407	Gafgyt	n/a
http://45.198.224.34/snype.arm5	6f8a2acdd7548976cf8c9b4a8fe8c984c2a43559d92e0dd3258263b6fefbb9d0	Mirai	n/a
http://45.198.224.34/snype.arm6	c46ba704f0f9551e9ef403318916a5a2d7108b8a87b2525dbfc6fbdd25770ed0	Gafgyt	n/a
http://45.198.224.34/snype.armv4l	1388bde12ececcf57506a1ab5f8bade4afdaed438dd5a6a18e763236ba623407	Gafgyt	n/a
http://45.198.224.34/snype.armv5l	6f8a2acdd7548976cf8c9b4a8fe8c984c2a43559d92e0dd3258263b6fefbb9d0	Mirai	n/a
http://45.198.224.34/snype.armv6l	c46ba704f0f9551e9ef403318916a5a2d7108b8a87b2525dbfc6fbdd25770ed0	Gafgyt	n/a
http://45.198.224.34/snype.armv7l	957aa6432f9f433165a78ab74aa061f7a074ccdf08509704daa126591f70b445	Gafgyt	n/a
http://45.198.224.34/snype.i586	3f53a09a26969e8aa6c38b421a1ea41be83763fddc3e968e7c1f0f2b1b084474	Mirai	n/a
http://45.198.224.34/snype.i686	3d85c12db5d25c9ee68edf5a868d934b6fd55d22ecbbdb08952d0bf31be008ee	Mirai	n/a
http://45.198.224.34/snype.m68k	8d7fb95adaac4e03f62c601cc62484c6cd2be2047e10a8d4b756e9c732ea0619	Mirai	n/a
http://45.198.224.34/snype.powerpc	379d762e3da04fd773ffc5d60fcd3128bed3246e85899994a42bdae96d1c3733	Gafgyt	n/a
http://45.198.224.34/snype.sh4	ac472a2e063ab67384f81396c46c7dfd2e3c37976edb972600ece01b88e026a3	Mirai	n/a
http://45.198.224.34/snype.x86_64	d81d9de5d82bca654f4148fa7634707623c39573242650fae2bf32d4b7b4591b	Gafgyt	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-11T18:01:00Z UTC

Last seen:

2026-10-13T15:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b76fa6a99a421264c0c6f2fd4d300adc100fe552cb6b0db4e2d995e0b2197fbc/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e2dab263-bca6-440d-aff3-3aee6016e62f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b76fa6a99a421264c0c6f2fd4d300adc100fe552cb6b0db4e2d995e0b2197fbc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b76fa6a99a421264c0c6f2fd4d300adc100fe552cb6b0db4e2d995e0b2197fbc/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-11 22:19:50 UTC

File Type:

Text (Shell)

AV detection:

25 of 38 (65.79%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w5x2nkm2iijgjqgg6l6u2mak3qia7zksznvq3nhc3gk6bmqzp66a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261011-3t2svssx6k/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh