Extracted

• • Target

    f970e2afe2d0fab6fbf2eab0e3d1e555d3fed10a6bf1b7929069f12689d28985.sh

  • Size

    1KB

  • MD5

    3189d19ad6f6f1da0267b0390a050ceb

  • SHA1

    eadeb7723eac480febdf3a5dba6452c0f8e1b710

  • SHA256

    f970e2afe2d0fab6fbf2eab0e3d1e555d3fed10a6bf1b7929069f12689d28985

  • SHA512

    143874393ca2612bbfc81d451f16c45eab4c0c119fe0fa63a3ce6c74baba6dade2d0a241694dff2d4470228853f82dc6d4dc2ede4f18128de2c70cb27ac9a526

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4