Extracted

• • Target

    tyo2831qq.x86.elf

  • Size

    164KB

  • MD5

    4ac062e7bafef554949de20763c54f7b

  • SHA1

    24355a299d9aca3953a9fac256cdaf7be0249fda

  • SHA256

    33368eb166229b262cb964cfa6412478278b2a23e5f0c3de24a56c28dac5eeb0

  • SHA512

    b12f82c346dbe62b6a96e7c9d3185eb2fdca9cc29ba83e29a102fd746c93d72d919d8146840ab9338dc8a25a7fb2b400a0cd9d0ac2ea5a0471d283f81d115bb9

  • SSDEEP

    3072:62RroorS3/kjk3GWOwnzuXr+wMxphaMpFncunTieFIMK0UpW2mBT38dAY4:6IrqnrVxphaM2SFcRmBT38dAY4

  Score

  10^/10

  gafgytbotnetdiscoveryexecutionpersistenceprivilege_escalatio

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Writes file to system bin folder

  behavioral1