MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e
SHA3-384 hash:	1d307327013f0250e54d982d5a9acc75007395e1b271ded08cde9b6f77ce533f03382cb46fbfa405a9fb48b49437169d
SHA1 hash:	7a4cd049fe19cfd5935587d70d8bf4a9615e7b54
MD5 hash:	6fa1c85e16d5d4c5d759e49bf31b4ac4
humanhash:	fix-edward-quebec-artist
File name:	t
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	1'571 bytes
First seen:	2025-01-03 03:36:33 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2Gv5YLkn5p3YLy+ZMuLlxM+HIpVMYLt2HI3NYLOHImvYLC+HIluLoR3uOlYI:sF+3vcMmaEA1LtTYC6eEBl1rJI
TLSH	T13A31CED554A248F53DF0994B736BCC1EB29A358E1DC18F89A8CC38F7648CC50B551B23
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.90/x86_64	b75eab90673b94fd015bc817741fe37bfaee97166f5430e327c578bd57622349	Mirai	elf gafgyt mirai
http://83.222.191.90/mpsl	fb8c4375a130519b1efde83331104660d2e86beb26ea7fc0cff76eaa8ac92dcd	Mirai	elf gafgyt mirai
http://83.222.191.90/mips	834cc6baf7ebac043e45709e9b8f0f1392ec77636c35e4db9aa4c689e31e1c07	Mirai	elf gafgyt mirai
http://83.222.191.90/arm4	29d06b4e031c7f67717e1406e936132e62ec6756fbfb3385ff887a327afee967	Mirai	elf gafgyt mirai
http://83.222.191.90/arm5	a1a8c3f6c6d4fc6e12fd4d2a8e8752c0cfe7aaa90e995d26ae15e1817fa766e3	Mirai	elf gafgyt mirai
http://83.222.191.90/arm6	f6e83a004ecbe7fb573cbd4eb727cf9dd852f2e4f9881b7cdf2c8466619e1f73	Mirai	elf gafgyt mirai
http://83.222.191.90/arm7	1d7d6749e49dad1984f278f121649b964e9ebd5a02892ee2024469ce0fe2ff6e	Mirai	elf gafgyt mirai
http://83.222.191.90/m68k	87da76e636c2d9e189ad5459810887b367769a6aaba457f10ac57e936dd0dc96	Mirai	elf gafgyt mirai
http://83.222.191.90/x86	5e32cd9ca17361b8deea9202641ff4db44bbc56324ba81b880a457b62f892cac	Mirai	elf gafgyt mirai
http://83.222.191.90/spc	ac93db4801f970a44992f548c1f814b66aa02e596ba7f9eaf5bd6d5952fb36fc	Mirai	elf gafgyt mirai
http://83.222.191.90/ppc	73363cf068841767dd08e4caac4f5a2eca9b39a30c1e7efcb243e97c3c8b7292	Mirai	elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67778a4d1ada707798257b53linux22vpnfull_triage

Tags:

backdoor hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug busybox evasive

Link:

https://www.filescan.io/uploads/67775b6396abc38397b893b1/reports/809b485d-ee40-4dcd-a08b-008f5466fb9a/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e

Result

Verdict:

UNKNOWN

Score:

65%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-01-03 06:12:28 UTC

File Type:

Text (Shell)

AV detection:

19 of 38 (50.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4d4ruvwzdpwtf5alzp3r54w3zy45yq5j2iqkvywifnsgsxb5boha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250103-hqxphswngq/

Behaviour

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e0f91a56d91bed32f40bcbf71ef2dbce39dc43a9d220aae2c82b64695c3d0b8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.