MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gafgyt

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4
SHA3-384 hash:	920b33fb7417dd35a40320c9249b61a65fec5035a5ba4162957d035fbbf8c70e8d8307de656e025689ec0d06849c8986
SHA1 hash:	94e6532fbbc30bf120997d4d95f67f590c293be1
MD5 hash:	4e38a07abb5944a53509647b34ee2a39
humanhash:	thirteen-montana-washington-yankee
File name:	weed
Download:	download sample
Signature	Gafgyt Create hunting rule
File size:	4'690 bytes
First seen:	2025-03-01 23:47:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:1x121313f1V17c1T1SX7p8nvJWi5hah3h3vhdh7ghLhSXAn63CE7ZeSXh8aeGcm5:daF39XgRSX7p8nvJWi5hah3h3vhdhshO
TLSH	T159A14BAC3A534BBA8E95DF5FE3218451F48A91C26474CF2C289D70F8B9BFE84512094F
Magika	shell
Reporter	abuse_ch
Tags:	Hailbot sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.232.205.129/mips	aefbdb36464fe9b729a4653d08bdbc868908f4610ee6fee860bfcab23e784491	Gafgyt	32-bit elf gafgyt
http://185.232.205.129/mpsl	8ab158e1759dce18af202dd6a8e6be20a82c958f4538801a81cf9ce154fc3014	Gafgyt	ddos elf gafgyt mirai
http://185.232.205.129/x86	933012e45a0551e817efce800288b0677b39f4b1838eb1349ed35a017fd22896	Gafgyt	64-bit elf gafgyt
http://185.232.205.129/arm	cfa48d7fdd539176406e8e7185d3fa69f7a8405a9b0bcd6d75c844e5322b129c	Mirai	ddos elf mirai
http://185.232.205.129/arm5	887be8b3f4a1efa8c4dd1be3a6f95fb15c843e33f1fabf4b6a0e9ce12cbc262a	Mirai	ddos elf mirai
http://185.232.205.129/arm6	n/a	n/a	n/a
http://185.232.205.129/arm7	n/a	n/a	n/a
ftp://5.232.205.129:8021/mips	n/a	n/a	n/a
ftp://5.232.205.129:8021/mpsl	n/a	n/a	n/a
ftp://5.232.205.129:8021/x86	n/a	n/a	n/a
ftp://5.232.205.129:8021/arm	n/a	n/a	n/a
ftp://5.232.205.129:8021/arm5	n/a	n/a	n/a
ftp://5.232.205.129:8021/arm7	n/a	n/a	n/a
ftp://5.232.205.129:8021/arm6	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c4254ec668b65489be54aclinux22vpnfull_triage

Tags:

trojan agent virus

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4

Result

Verdict:

MALICIOUS

Score:

36%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-03-02 00:35:42 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=644fssyikm7gnby2xajd5tpcwrbv332yoe2fur5nrrii2iylts2a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f738594b08533e66871ab8123ecde2b4435def5871345a47ad8c508d230b9cb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.