MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf
SHA3-384 hash:	c2dfc900ef1d3bc19eb5ec72a39043c65678bbf609c2663a951db058363d201d8d22e186287869dec8079ececf421a09
SHA1 hash:	32feb80f7d358e6e387ef8c90ba2c5ea8b8f9c48
MD5 hash:	797a1b68e2da1546aa086a9188e5c873
humanhash:	five-fix-mike-ceiling
File name:	p
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	835 bytes
First seen:	2026-07-21 05:41:56 UTC
Last seen:	2026-07-22 04:51:15 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaFCme/QCS4Mx7C92QWCGvpC0FauD:kXCKysE2hi0ziQvZohaF/e4D4MlbdJ7
TLSH	T1AF016FC64650AD108069995D729762A0B421C3CF56870FB87FDC5D3DFB9C914F066F9C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.114.124/FN6	8f0a5b5d0d72b8666ba34d37388a03b10e8843e5175bde81b4b80e40965b3893	Gafgyt	arm elf ua-wget
http://129.121.114.124/fjBe	cd82561ce031428ee795db124e8a0ec913e8456e30926e64e8aeeeaf2c372483	Mirai	arm elf mirai ua-wget
http://129.121.114.124/U9Z	d6450f1bf394bd2982f3639155e2f8a0af04afd4eacb049793a10a5a7c046a9d	Mirai	arm elf ua-wget
http://129.121.114.124/oXx	c5fce7e926ebe9765b7dc39c2e7904d4ad04ad79fb5837af5d053cc9003bb298	Mirai	elf mips ua-wget
http://129.121.114.124/OUi7	86118665e6ed6daf79b7e33a64708cb60befc5e55962faed8bdd7dfecff18fc1	Mirai	elf mips ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a5f06d0c6d0ad38e66cf771/reports/d7bc6151-b75a-4649-a9c0-3eae737501cc/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-21T04:02:00Z UTC

Last seen:

2026-07-21T06:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c32057f8-91a5-4294-899b-4c4b9e848464

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf/

Threat name:

Document-HTML.Trojan.Bash

Status:

Malicious

First seen:

2026-07-21 05:44:11 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4fqmjp74vv3jvbbqho2chwriujecx4oqesr27ycizkl5wmmjtxhq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260721-gec1asfz2p/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.