Overview

overview

10

Static

static

1

6594875b01...417.sh

ubuntu-18.04-amd64

10

6594875b01...417.sh

debian-9-armhf

10

6594875b01...417.sh

debian-9-mips

10

6594875b01...417.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6594875b01074eed48ca4021e4079aefb23565c88d5eccab3939241746347417.sh

  • Size

    6KB

  • Sample

    241208-cwhjwsspcn

  • MD5

    b853a7496951ffa293c154a1c2ab0cef

  • SHA1

    cd23d84bfa383cb3eef6b8a210a755323d278068

  • SHA256

    6594875b01074eed48ca4021e4079aefb23565c88d5eccab3939241746347417

  • SHA512

    315201607fbfeb29173ced022cebb46a1c936377bb62407fdb73bb9a65426e24aff333c7e727e5fbb7351de6f71f919e1dcec3204b41d01d781dfcfc171bab18

  • SSDEEP

    96:vl0lolAlUlElAlwlclElElglUl6LlbzPnTjn37jjHTLXjTp+FH7RjdOMX+xj+wqd:oMVB3

Score
10/10
gafgytantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      6594875b01074eed48ca4021e4079aefb23565c88d5eccab3939241746347417.sh

    • Size

      6KB

    • MD5

      b853a7496951ffa293c154a1c2ab0cef

    • SHA1

      cd23d84bfa383cb3eef6b8a210a755323d278068

    • SHA256

      6594875b01074eed48ca4021e4079aefb23565c88d5eccab3939241746347417

    • SHA512

      315201607fbfeb29173ced022cebb46a1c936377bb62407fdb73bb9a65426e24aff333c7e727e5fbb7351de6f71f919e1dcec3204b41d01d781dfcfc171bab18

    • SSDEEP

      96:vl0lolAlUlElAlwlclElElglUl6LlbzPnTjn37jjHTLXjTp+FH7RjdOMX+xj+wqd:oMVB3

    Score
    10/10
    gafgytbotnetdefense_evasiondiscoveryantivm

    • Detected Gafgyt variant

    • Gafgyt family

      gafgyt

    • Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks