Analysis

  • max time kernel
    84s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09-11-2024 04:09

General

  • Target

    tyo2831qq.x86.elf

  • Size

    164KB

  • MD5

    4ac062e7bafef554949de20763c54f7b

  • SHA1

    24355a299d9aca3953a9fac256cdaf7be0249fda

  • SHA256

    33368eb166229b262cb964cfa6412478278b2a23e5f0c3de24a56c28dac5eeb0

  • SHA512

    b12f82c346dbe62b6a96e7c9d3185eb2fdca9cc29ba83e29a102fd746c93d72d919d8146840ab9338dc8a25a7fb2b400a0cd9d0ac2ea5a0471d283f81d115bb9

  • SSDEEP

    3072:62RroorS3/kjk3GWOwnzuXr+wMxphaMpFncunTieFIMK0UpW2mBT38dAY4:6IrqnrVxphaM2SFcRmBT38dAY4

Malware Config

Extracted

Family

gafgyt

C2

31.172.80.237:706

Signatures

  • Detected Gafgyt variant 2 IoCs
  • Gafgyt family
  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

  • Executes dropped EXE 44 IoCs
  • Creates/modifies Cron job 1 TTPs 44 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Writes file to system bin folder 1 IoCs
  • Reads runtime system information 45 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 45 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/tyo2831qq.x86.elf
    /tmp/tyo2831qq.x86.elf
    1⤵
    • Creates/modifies Cron job
    • Writes file to system bin folder
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1500
    • /tmp/filetypTHP
      /tmp/tyo2831qq.x86.elf
      2⤵
      • Executes dropped EXE
      • Creates/modifies Cron job
      • Reads runtime system information
      • Writes file to tmp directory
      PID:1504
      • /tmp/filetPWVCX
        /tmp/tyo2831qq.x86.elf
        3⤵
        • Executes dropped EXE
        • Creates/modifies Cron job
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1505
        • /tmp/file4IrhXZ
          /tmp/tyo2831qq.x86.elf
          4⤵
          • Executes dropped EXE
          • Creates/modifies Cron job
          • Reads runtime system information
          • Writes file to tmp directory
          PID:1506
          • /tmp/filejjfKV2
            /tmp/tyo2831qq.x86.elf
            5⤵
            • Executes dropped EXE
            • Creates/modifies Cron job
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1507
            • /tmp/fileol5O31
              /tmp/tyo2831qq.x86.elf
              6⤵
              • Executes dropped EXE
              • Creates/modifies Cron job
              • Reads runtime system information
              • Writes file to tmp directory
              PID:1508
              • /tmp/fileRICDTW
                /tmp/tyo2831qq.x86.elf
                7⤵
                • Executes dropped EXE
                • Creates/modifies Cron job
                • Reads runtime system information
                • Writes file to tmp directory
                PID:1509
                • /tmp/file25mfc0
                  /tmp/tyo2831qq.x86.elf
                  8⤵
                  • Executes dropped EXE
                  • Creates/modifies Cron job
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:1510
                  • /tmp/fileKea4vV
                    /tmp/tyo2831qq.x86.elf
                    9⤵
                    • Executes dropped EXE
                    • Creates/modifies Cron job
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:1511
                    • /tmp/fileTWdAI5
                      /tmp/tyo2831qq.x86.elf
                      10⤵
                      • Executes dropped EXE
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:1512
                      • /tmp/fileHDP6yd
                        /tmp/tyo2831qq.x86.elf
                        11⤵
                        • Executes dropped EXE
                        • Creates/modifies Cron job
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:1513
                        • /tmp/filedx7FQd
                          /tmp/tyo2831qq.x86.elf
                          12⤵
                          • Executes dropped EXE
                          • Creates/modifies Cron job
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:1514
                          • /tmp/fileL8oi2g
                            /tmp/tyo2831qq.x86.elf
                            13⤵
                            • Executes dropped EXE
                            • Creates/modifies Cron job
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:1515
                            • /tmp/fileuxsdXi
                              /tmp/tyo2831qq.x86.elf
                              14⤵
                              • Executes dropped EXE
                              • Creates/modifies Cron job
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:1516
                              • /tmp/filemB0QBj
                                /tmp/tyo2831qq.x86.elf
                                15⤵
                                • Executes dropped EXE
                                • Creates/modifies Cron job
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:1517
                                • /tmp/filee3PW3i
                                  /tmp/tyo2831qq.x86.elf
                                  16⤵
                                  • Executes dropped EXE
                                  • Creates/modifies Cron job
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:1520
                                  • /tmp/file5hx6Xg
                                    /tmp/tyo2831qq.x86.elf
                                    17⤵
                                    • Executes dropped EXE
                                    • Creates/modifies Cron job
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:1521
                                    • /tmp/fileo1Ggxg
                                      /tmp/tyo2831qq.x86.elf
                                      18⤵
                                      • Executes dropped EXE
                                      • Creates/modifies Cron job
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:1522
                                      • /tmp/filePDohpm
                                        /tmp/tyo2831qq.x86.elf
                                        19⤵
                                        • Executes dropped EXE
                                        • Creates/modifies Cron job
                                        • Reads runtime system information
                                        • Writes file to tmp directory
                                        PID:1523
                                        • /tmp/file9EdyXl
                                          /tmp/tyo2831qq.x86.elf
                                          20⤵
                                          • Executes dropped EXE
                                          • Creates/modifies Cron job
                                          • Reads runtime system information
                                          • Writes file to tmp directory
                                          PID:1524
                                          • /tmp/fileUa1NVl
                                            /tmp/tyo2831qq.x86.elf
                                            21⤵
                                            • Executes dropped EXE
                                            • Creates/modifies Cron job
                                            • Reads runtime system information
                                            • Writes file to tmp directory
                                            PID:1525
                                            • /tmp/file8uMF1l
                                              /tmp/tyo2831qq.x86.elf
                                              22⤵
                                              • Executes dropped EXE
                                              • Creates/modifies Cron job
                                              • Reads runtime system information
                                              • Writes file to tmp directory
                                              PID:1526
                                              • /tmp/fileeInw9l
                                                /tmp/tyo2831qq.x86.elf
                                                23⤵
                                                • Executes dropped EXE
                                                • Creates/modifies Cron job
                                                • Reads runtime system information
                                                • Writes file to tmp directory
                                                PID:1527
                                                • /tmp/fileQgrnfh
                                                  /tmp/tyo2831qq.x86.elf
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Creates/modifies Cron job
                                                  • Reads runtime system information
                                                  • Writes file to tmp directory
                                                  PID:1528
                                                  • /tmp/file8Lj3Vh
                                                    /tmp/tyo2831qq.x86.elf
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Creates/modifies Cron job
                                                    • Reads runtime system information
                                                    • Writes file to tmp directory
                                                    PID:1529
                                                    • /tmp/filewYrpbg
                                                      /tmp/tyo2831qq.x86.elf
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Creates/modifies Cron job
                                                      • Reads runtime system information
                                                      • Writes file to tmp directory
                                                      PID:1530
                                                      • /tmp/filethKssd
                                                        /tmp/tyo2831qq.x86.elf
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Creates/modifies Cron job
                                                        • Reads runtime system information
                                                        • Writes file to tmp directory
                                                        PID:1531
                                                        • /tmp/fileuRpwAa
                                                          /tmp/tyo2831qq.x86.elf
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Creates/modifies Cron job
                                                          • Reads runtime system information
                                                          • Writes file to tmp directory
                                                          PID:1532
                                                          • /tmp/filee4x1rd
                                                            /tmp/tyo2831qq.x86.elf
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Creates/modifies Cron job
                                                            • Reads runtime system information
                                                            • Writes file to tmp directory
                                                            PID:1533
                                                            • /tmp/fileMg1YGg
                                                              /tmp/tyo2831qq.x86.elf
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Creates/modifies Cron job
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:1534
                                                              • /tmp/fileIsHo9j
                                                                /tmp/tyo2831qq.x86.elf
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Creates/modifies Cron job
                                                                • Reads runtime system information
                                                                • Writes file to tmp directory
                                                                PID:1535
                                                                • /tmp/file9HaENn
                                                                  /tmp/tyo2831qq.x86.elf
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Creates/modifies Cron job
                                                                  • Reads runtime system information
                                                                  • Writes file to tmp directory
                                                                  PID:1536
                                                                  • /tmp/filejx9O4r
                                                                    /tmp/tyo2831qq.x86.elf
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Creates/modifies Cron job
                                                                    • Reads runtime system information
                                                                    • Writes file to tmp directory
                                                                    PID:1537
                                                                    • /tmp/file39w9Iz
                                                                      /tmp/tyo2831qq.x86.elf
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Creates/modifies Cron job
                                                                      • Reads runtime system information
                                                                      • Writes file to tmp directory
                                                                      PID:1538
                                                                      • /tmp/filek2O76z
                                                                        /tmp/tyo2831qq.x86.elf
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Creates/modifies Cron job
                                                                        • Reads runtime system information
                                                                        • Writes file to tmp directory
                                                                        PID:1539
                                                                        • /tmp/fileLx7EhH
                                                                          /tmp/tyo2831qq.x86.elf
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Creates/modifies Cron job
                                                                          • Reads runtime system information
                                                                          • Writes file to tmp directory
                                                                          PID:1540
                                                                          • /tmp/filepBA5XP
                                                                            /tmp/tyo2831qq.x86.elf
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Creates/modifies Cron job
                                                                            • Reads runtime system information
                                                                            • Writes file to tmp directory
                                                                            PID:1541
                                                                            • /tmp/file4KvgdL
                                                                              /tmp/tyo2831qq.x86.elf
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Creates/modifies Cron job
                                                                              • Reads runtime system information
                                                                              • Writes file to tmp directory
                                                                              PID:1542
                                                                              • /tmp/fileNWoLxH
                                                                                /tmp/tyo2831qq.x86.elf
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Creates/modifies Cron job
                                                                                • Reads runtime system information
                                                                                • Writes file to tmp directory
                                                                                PID:1543
                                                                                • /tmp/fileJuCPdH
                                                                                  /tmp/tyo2831qq.x86.elf
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Creates/modifies Cron job
                                                                                  • Reads runtime system information
                                                                                  • Writes file to tmp directory
                                                                                  PID:1544
                                                                                  • /tmp/file8xdTOM
                                                                                    /tmp/tyo2831qq.x86.elf
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Creates/modifies Cron job
                                                                                    • Reads runtime system information
                                                                                    • Writes file to tmp directory
                                                                                    PID:1545
                                                                                    • /tmp/fileHWigTK
                                                                                      /tmp/tyo2831qq.x86.elf
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Creates/modifies Cron job
                                                                                      • Reads runtime system information
                                                                                      • Writes file to tmp directory
                                                                                      PID:1546
                                                                                      • /tmp/fileaEomLO
                                                                                        /tmp/tyo2831qq.x86.elf
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Creates/modifies Cron job
                                                                                        • Reads runtime system information
                                                                                        • Writes file to tmp directory
                                                                                        PID:1547
                                                                                        • /tmp/file0dGPLU
                                                                                          /tmp/tyo2831qq.x86.elf
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Creates/modifies Cron job
                                                                                          • Reads runtime system information
                                                                                          • Writes file to tmp directory
                                                                                          PID:1548
                                                                                          • /tmp/filetRQhiY
                                                                                            /tmp/tyo2831qq.x86.elf
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Reads runtime system information
                                                                                            • Writes file to tmp directory
                                                                                            PID:1549

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /etc/cron.hourly/0

    Filesize

    92B

    MD5

    3f006f7f81fc17be7f4a0d3da0fad5de

    SHA1

    97a94d3d0654c6551057af3809b52572bd7f9f5d

    SHA256

    982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf

    SHA512

    97d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0

  • /tmp/filetypTHP

    Filesize

    156KB

    MD5

    a8a6992775589faecef1bc8cf38bdfc5

    SHA1

    b6903301aecf34539654f309b8c12773461920dc

    SHA256

    cae053bfac71081a19bd64ae66f3fc9a149bcbe492eeb46d33647e01ab18eb52

    SHA512

    dd803894a1bb9caa2bb4d1da70d35a531a7f76718d23392ff7ee511f489f413f2c79e82a3d7432685a36f470b69c74d211d18d050bee1a5d261c75131ee58fb8

  • /tmp/filetypTHP

    Filesize

    164KB

    MD5

    4ac062e7bafef554949de20763c54f7b

    SHA1

    24355a299d9aca3953a9fac256cdaf7be0249fda

    SHA256

    33368eb166229b262cb964cfa6412478278b2a23e5f0c3de24a56c28dac5eeb0

    SHA512

    b12f82c346dbe62b6a96e7c9d3185eb2fdca9cc29ba83e29a102fd746c93d72d919d8146840ab9338dc8a25a7fb2b400a0cd9d0ac2ea5a0471d283f81d115bb9