MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c78112ca40367853ccd45dcff6c81c57b7df41a97d903530c512277956807f57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c78112ca40367853ccd45dcff6c81c57b7df41a97d903530c512277956807f57
SHA3-384 hash:	9b2786de368c62462213294677bb772a05e4d48d6e55af28d1f1d2354a7f3eee96949be7ae7e79482506ffca696f9bd0
SHA1 hash:	f45dff460aaf4177b0c0ebdb51c9eab704d85d20
MD5 hash:	d6b49360dd6f1aaaada77b0001af288d
humanhash:	seventeen-zulu-item-lemon
File name:	bins.sh
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'983 bytes
First seen:	2025-02-21 12:17:30 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:1kDEDQgoyuCCJ2bvUQoLZAX53Y8xCCeke9eof7:1kYDQgoyuCCJ2bvUQoLZAXxY8xCCeket
TLSH	T1A8416FCE616304B92FB0EE3B31F5845475C6E29A24DABF067DEC39E840CDE0428C4697
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://37.44.238.66/sly.mips	928f36bba1aad95c0a0b066957f45c45d86e2c870fd7e158d4cae7ea52adb308	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.mpsl	26923b7d86e00f9605881a4de838be5c61fa3146b02975d02d40c24a9d6650f8	HeliBot	censys elf HeliBot opendir
http://37.44.238.66/sly.sh4	d0db6459d6d09dd6f5680e5c25fb23df18cf806508f81476de44d9133b139959	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.x86	79d8e8d9eec478dbbda7657ef95f6c1b97efd0d79d5bc275d0aec2bb02987288	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.arm6	5636d0bf0c441aa5cd05e6c855e58ded740ca95aa673290f7530b04568cf71bb	HeliBot	censys elf HeliBot opendir
http://37.44.238.66/sly.i686	3bde884dfc0719672e176a5acf7183878eb98b72fec80299eed52cd55347a0dc	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.ppc	736d3db0db57bdc20dbe3151deb6e7013dcab38ad31f4e9d5a0a835ae3ba8d98	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.i586	b774462783a61ea6827cdd5170f1c431a749d0a846f7c7eb140de66a7c73ea00	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.m68k	8f8392669f89db0f70d215778fa66979b42ed6a9a26bafdaeabcd183d9b313b2	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.sparc	6d586ef9b07c125ac32e1245e2a0236e40fe98c3ba20facc1c587f264e242f25	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.arm4	7b58f38a2edf4bc85613349ec6826b7c13f63cb394996afca284707fc9fc537f	Gafgyt	censys elf gafgyt opendir
http://37.44.238.66/sly.arm5	36f721844bcf9cf63109dda76d5e3d9e6b7655cc9b80ceefa21061e46a0fc1a4	HeliBot	censys elf HeliBot opendir
http://37.44.238.66/sly.arm7	n/a	n/a	n/a
http://37.44.238.66/sly.ppc440fp	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b86f2028ab76d43a5c46eblinux22vpnfull_triage

Tags:

downloader trojan agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/67b86f165b81efb9a696e794/reports/5bc31583-955f-4324-9552-79073471a598/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c78112ca40367853ccd45dcff6c81c57b7df41a97d903530c512277956807f57

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c78112ca40367853ccd45dcff6c81c57b7df41a97d903530c512277956807f57/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-02-21 12:18:21 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y6arfssagz4fhtgulxh7nsa4k6356qnjpwidkmgfcitxsvuap5lq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250221-pgntkssjgm/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c78112ca40367853ccd45dcff6c81c57b7df41a97d903530c512277956807f57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.