Extracted

• • Target

    d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e.sh

  • Size

    2KB

  • MD5

    0f886518495ede0d60cb0be5653a4907

  • SHA1

    8adeb236ab6d2503646382bfbbfc9d24aea427c2

  • SHA256

    d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e

  • SHA512

    61c8ccce22606ef885b6d79c9093b9fbdc977a9ab39d80715117b21d0251b6134c69682bee3ae667884e6ad3d85f9ef9ec75fb101c59e30cb02b73ab0fc0df7a

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4