TF-1932601
high
📛 Threat Title
Bashlite: SHA256 hash of a malware sample (payload) 1dc37e8413a51944538b79eb66ccefe9d79265faa1d3c61a2d43f218a45633bd
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Bashlite (aliases: gayfgt,Gafgyt,qbot,torlus,lizkebab). Confidence: 100. First seen: 2026-09-25 02:44:52 UTC. Reporter: whack_sh. Tags: Bashlite, elf, Gafgyt.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
1dc37e8413a51944538b79eb66ccefe9d79265faa1d3c61a2d43f218a45633bd
IOC database
- Type
- hash_sha256
- Value
1dc37e8413a51944538b79eb66ccefe9d79265faa1d3c61a2d43f218a45633bd- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- URLhaus payload hash
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Bashlite (aliases: gayfgt,Gafgyt,qbot,torlus,lizkebab). Confidence: 100. First seen: 2026-09-25 02:44:52 UTC. Reporter: whack_sh. Tags: Bashlite, elf, Gafgyt.
Remediations (10)
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
Malware samples associated with tag bashlite MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with bashlite . Database Entry
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:github.com
A public repository that provides regularly updated lists of malicious file hashes (MD5, SHA-1, SHA-256 ) and related metadata for use in firewall, gateway endpoint or other security device blocking...
-
web:github.com
🔐 Malicious Hash Threat Intelligence Repository A curated collection of malicious file hashes (MD5 / SHA-1 / SHA-256 ) that can be used for blocking, detection and threat hunting across firewalls, EDR, SIEM, SOAR and other security platforms.
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:osintdashboard.dev
Look up MD5, SHA-1, or SHA-256 file hashes against malware databases to check if a file is known malicious.
-
web:osintlibrary.com
Look up a file hash against malware repositories and sandboxes — 21 OSINT tools that turn an MD5/SHA-256 into samples , verdicts, and intel.
-
web:www.huntress.com
The creators of Bashlite remain anonymous, though early analysis suggests it originated as part of underground cybercrime operations. The open availability of its source code has allowed multiple threat actors to modify and repurpose the malware for various malicious goals.
-
web:www.sectools.io
Look up file hashes (MD5, SHA-1, SHA-256 ) against malware databases to check if a file is known malicious. Verify downloaded files, investigate suspicious binaries, and check indicators of compromise.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.