MB-fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524
high
📛 Threat Title
Unknown: Gonelijek
Description
File type: unknown. Size: 114 bytes. Reporter: BlinkzSec. First seen: 2026-05-13 18:50:39.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524
VT: VT base fetch failed: ConnectionError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/files/fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524 (Caused by NameResolutionError("HTTPSConnection(host='www.virustotal.com', port=443): Failed to resolve 'www.virustotal.com' ([Errno -3] Temporary failure in name resolution)"))
IOC database
- Type
- hash_sha256
- Value
fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: ConnectionError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/files/fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524 (Caused by NameResolutionError("HTTPSConnection(host='www.virustotal.com', port=443): Failed to resolve 'www.virustotal.com' ([Errno -3] Temporary failure in name resolution)"))
hash_md5
f2cfb08f894be1d2fd289aeb46c35d67
VT 29 / 75
IOC database
- Type
- hash_md5
- Value
f2cfb08f894be1d2fd289aeb46c35d67- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 29 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Trojan:Linux/Amos.A |
| ALYac | malicious | Generic.SH.Amos.A.CAD061F6 |
| Antiy-AVL | malicious | Trojan/MacOS.Agent |
| Arcabit | malicious | Generic.SH.Amos.A.CAD061F6 |
| Avast | malicious | MacOS:Downloader-GZ [Drp] |
| AVG | malicious | MacOS:Downloader-GZ [Drp] |
| Avira | malicious | DR/OSX.Downloader.HD |
| BitDefender | malicious | Generic.SH.Amos.A.CAD061F6 |
| CAT-QuickHeal | malicious | Script.Trojan.A25506072 |
| CTX | malicious | shell.unknown.amos |
| Cynet | malicious | Malicious (score: 99) |
| DrWeb | malicious | Linux.DownLoader.2650 |
| Emsisoft | malicious | Generic.SH.Amos.A.CAD061F6 (B) |
| ESET-NOD32 | malicious | OSX/TrojanDownloader.Agent.CD trojan |
| F-Secure | malicious | Dropper.DR/OSX.Downloader.HD |
| GData | malicious | Generic.SH.Amos.A.CAD061F6 |
| malicious | Detected |
|
| huorong | malicious | TrojanDownloader/OSX.Maloader.a!crit |
| Ikarus | malicious | Trojan-Downloader.OSX.Agent |
| Lionic | malicious | Trojan.Script.Amos.4!c |
| McAfeeD | malicious | ti!FA77913EB1A2 |
| MicroWorld-eScan | malicious | Generic.SH.Amos.A.CAD061F6 |
| Rising | malicious | Downloader.Agent/OSX!9.704FB (XSE:WFNFX0JBVDr4SWzm/2XvPkALoJv1OafG) |
| Sophos | malicious | Troj/Dloadr-EIN |
| Symantec | malicious | OSX.Trojan.Gen |
| Varist | malicious | ABDownloader.HYL |
| VIPRE | malicious | Generic.SH.Amos.A.CAD061F6 |
| Xcitium | malicious | Malware@#1mopdoiof480t |
| ZoneAlarm | malicious | Troj/Dloadr-EIN |
Details From VirusTotal
Basic Properties
| MD5 | f2cfb08f894be1d2fd289aeb46c35d67 |
| SHA-1 | ee9e866e3dfcc40bb8d1552730960b4016985569 |
| SHA-256 | fa77913eb1a201c6199369193103a334eeb47874ab3853c5b75697b12a7c4524 |
| SSDEEP | 3:ns3FV3ZNjDy9Kk7D5aFOdvpvDxB:WFV3v/8/H5a2pbxB |
| TLSH | T1FEB0924F0070D0F90C0905063369C2D5070C90A31F60088CD2002E2820B40603F8F2C0 |
| File type | Shell script |
| File type tag | shell |
| File extension | sh |
| Magic | ASCII text, with no line terminators |
| File size | 114 B |
History
| First seen on VirusTotal | 2026-04-22 08:02 UTC |
| Last submission | 2026-05-11 13:35 UTC |
| Last analysis | 2026-05-22 06:01 UTC |
| Last modified on VirusTotal | 2026-06-17 23:52 UTC |
Known Names
64.89.160.11_sample.bin411528846Gonelijek
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: unknown. Size: 114 bytes. Reporter: BlinkzSec. First seen: 2026-05-13 18:50:39.
Remediations (10)
-
web:learn.microsoft.com
Learn how to deal with unwanted mitigations in Windows Security, including a process to remove all mitigations and import a baseline configuration file instead.
-
web:nypost.com
Medical examiner breaks down excruciating cause of death from falling in NYC manhole — following mom Donike Gocaj's tragic demise
-
web:panorays.com
Discover the difference between remediation and mitigation in risk management and how each strategy impacts security and resilience.
-
web:www.cdc.gov
Remediation is nearly always indicated whenever an outbreak of Legionnaires' disease occurs. Remediation may also be indicated when control measures are ineffective or routine results indicate poor Legionella control. Remediation may also be appropriate in response to unexpected events (equipment failure or acts of nature) that disrupt the water system.
-
web:www.esd.whs.mil
Ensure configuration, asset, remediation , and mitigation management supports vulnerability management within the DODIN in accordance with DoD Instruction (DoDI) 8510.01. Support all systems, subsystems, and system components owned by or operated on behalf of DoD with efficient vulnerability assessment techniques, procedures, and capabilities.
-
web:www.justice.gov
As of May 15, 2026, Camp Lejeune Justice Act settlement offers exceed $876 million and settlement payouts exceed $665 million.
-
web:www.levelblue.com
The availability of an official mitigation shifts the defensive priority from purely detection-focused strategies to direct modification of WinRE behavior, making remediation both actionable and immediately impactful.
-
web:www.motleyrice.com
The latest news on Camp Lejeune lawsuits includes continued litigation of lawsuits filed by people who were potentially exposed to water containing toxic chemicals at Marine Corps Base Camp Lejeune. The deadline to file was August 10, 2024. Settlement offers have been made to some victims while others still wait.
-
web:www.navy.mil
The filing deadline set forth in the Camp Lejeune Justice Act (CLJA) has passed. For that reason, the Department of the Navy (DON) is no longer accepting new CLJA claims. If you filed your CLJA ...
-
web:www.torhoermanlaw.com
You may qualify for the Camp Lejeune Water Contamination Lawsuit if you lived or worked at Camp Lejeune (NC) for 30+ days between August 1953 and December 1987.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.