MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae
SHA3-384 hash:	f5438acfce64d4cd94cd1cb3440664992bd25f1687d8600c7777f4caa52d427a19871bcc9f6a4d3736aaab820e9e2df2
SHA1 hash:	b3020c7ab678334c4ba4e80775a7f86903f3b3b8
MD5 hash:	e7bedca7578054f7d6b63125bf8e82b4
humanhash:	twenty-nuts-lamp-diet
File name:	gig.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	216 bytes
First seen:	2025-02-10 16:41:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:L2UiMwWcqRvLdgoKxV7GBzSEyLTUWwOeXGUi9WFKV2UiMwWcqRvLdgoKoaBzSE89:LFwS8VCICX5FgFwSYNTxXk
TLSH	T112D0C9C544D33D518598AC997A7A813F9082C7CCA2170BCFA8CD0625EA4DB59FCB0A42
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67aa2c9f49f32dfb0d82dc20linux22vpnfull_triage

Tags:

hype sage

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae/

ReversingLabs TitaniumCloud Script-Shell.Browser.Tsunami

Threat name:

Script-Shell.Browser.Tsunami

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-10 16:42:20 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  4/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=45xo52we42sorz6js2yoxusp33qsmvd37hwisatluqxcsyelx2xa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

adware discovery persistence privilege_escalation stealer

Link:

https://tria.ge/reports/250210-t7rqdayjfx/

Behaviour

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Program Files directory

Drops file in System32 directory

Checks installed software on the system

Installs/modifies Browser Helper Object

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e76eeeeac4e6a4e8e7c996b0ebd24fdee126547bf9ec89026ba42e29608bbeae