Analysis
-
max time kernel
149s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
-
submitted
26-11-2024 03:27
General
-
Target
d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf
-
Size
137KB
-
MD5
6c729f11f6803f98780dd8fb703fd3f4
-
SHA1
c34ea885a9e186d052f47af72d4a7951afc868ab
-
SHA256
d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d
-
SHA512
9f3dcca10b0f0e317be246eedc8127dc198ce9b6c604608365304a5f1d018c4ee72c1e7999517113d0e88b5f9f4a757336bd4db91cca16e9fa189e613d686325
-
SSDEEP
3072:62RZGGZgLuthhI2fKGHOZOVp6iK65dnmr1zwTRWNn:6IkubvXz5Bmr1zwTRWNn
Score
10/10
Malware Config
Signatures
-
Detected Gafgyt variant 2 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
Executes dropped EXE 44 IoCs
-
Creates/modifies Cron job 1 TTPs 44 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder 1 IoCs
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 44 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf1⤵
- Creates/modifies Cron job
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file0WfRoQ/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf2⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileoHbECY/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf3⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file8ZPAdI/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf4⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filerieaLz/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf5⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filew7Ftdk/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf6⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filededo1p/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf7⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filezE9yHW/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf8⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileZOX7iz/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf9⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileZDyddC/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf10⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file5B7GWi/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf11⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filebSxXRV/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf12⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileWhc0ph/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf13⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filei2PwzU/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf14⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file9nyHCc/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf15⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file2G7H5Y/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf16⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filesFj05n/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf17⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileXMOR0E/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf18⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileI0f6k4/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf19⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file9sSuRa/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf20⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileghZMhY/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf21⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file8Dwbex/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf22⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileGMFBnE/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf23⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileBssqoB/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf24⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileSuj8PI/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf25⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filekjQh5B/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf26⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileN7QG1y/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf27⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file4ncDrb/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf28⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filewU07aK/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf29⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileHxaO7E/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf30⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file4pq8yX/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf31⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filegcxE52/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf32⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileifuTlW/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf33⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileuqiSUr/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf34⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileITHqh3/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf35⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenMhI5f/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf36⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file58qMJP/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf37⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileOVo2kx/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf38⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filemtWayI/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf39⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filePVV4XQ/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf40⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileivlepL/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf41⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filewLd1Ai/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf42⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filedZF8WB/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf43⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileVdmEM1/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf44⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileANG1pA/tmp/d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d.elf45⤵
- Executes dropped EXE
- Reads system routing table
- Changes its process name
- Reads system network configuration
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD53f006f7f81fc17be7f4a0d3da0fad5de
SHA197a94d3d0654c6551057af3809b52572bd7f9f5d
SHA256982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
SHA51297d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
-
Filesize
129KB
MD527bd44e4c530ed74dd07d47ed96b6c2f
SHA104968669348fe3cd4641f04a499777c69feaa306
SHA2568bc608a0a11065e89d412f35dce45af2823765de6000d2223b16c9e797eefb8a
SHA512913c5d2e4bf011b44b552f7118dbef34a3ef339757878ec04372b6768edba6e56b62cfa03606cb5ce1d09959931d5d2840768828614828d4730ccf7822c1e261
-
Filesize
137KB
MD56c729f11f6803f98780dd8fb703fd3f4
SHA1c34ea885a9e186d052f47af72d4a7951afc868ab
SHA256d6c811a85da0937edf987d3cd032b13903ba7ea0c1796f654f7c5a2c9593d55d
SHA5129f3dcca10b0f0e317be246eedc8127dc198ce9b6c604608365304a5f1d018c4ee72c1e7999517113d0e88b5f9f4a757336bd4db91cca16e9fa189e613d686325