Extracted

• • Target

    tyo2831qq.sh

  • Size

    1KB

  • MD5

    e12d6a1166c4e290ed4ba39f96c780ad

  • SHA1

    57038253b27c0312102758d25a77b5d1859cba3e

  • SHA256

    5f52ba20358d35d9705d4893c2e28bf333f9920d13053b21352be4a1fa6c8199

  • SHA512

    276aabcf2037ad435a105ded3f3bfb8491fb391d5e1d49942d41774807c3f0b4e15d1ed18a57f0d783cd9aafee3ce1a96e561d3ee6da02b5d6c51fc579bb91ee

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatioxmrigxmrig_linuxminer

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • Xmrig_linux family

    xmrig_linux

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Legitimate hosting services abused for malware hosting/C2

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4