Overview

overview

10

Static

static

1

logsbins.sh

ubuntu-18.04-amd64

10

logsbins.sh

debian-9-armhf

10

logsbins.sh

debian-9-mips

10

logsbins.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    logsbins.sh

  • Size

    6KB

  • Sample

    241210-h1hcksyjfz

  • MD5

    883541237878691fb889ea91320abb69

  • SHA1

    138fb857e27f94a8b74cde31332a4d4a621e3f94

  • SHA256

    79397473a675a56b9fd9508c9db02b8d351be9703130d21031e7381955b6ae1d

  • SHA512

    9009d803c1c01938aca4aa2577f0fcbe8dba2262cdf3b29342b986818e1e1ffbe7570254e19cbe1926210a7dc42506aa3ab64898a9fb45c7610220950852215a

  • SSDEEP

    192:+pdVJZVlRZZ1JhAYsk4Ik0gIIE4wUITy+WEgaIu2Uj6IjZqy/WT9TD55R2M:d

Score
10/10
gafgytantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      logsbins.sh

    • Size

      6KB

    • MD5

      883541237878691fb889ea91320abb69

    • SHA1

      138fb857e27f94a8b74cde31332a4d4a621e3f94

    • SHA256

      79397473a675a56b9fd9508c9db02b8d351be9703130d21031e7381955b6ae1d

    • SHA512

      9009d803c1c01938aca4aa2577f0fcbe8dba2262cdf3b29342b986818e1e1ffbe7570254e19cbe1926210a7dc42506aa3ab64898a9fb45c7610220950852215a

    • SSDEEP

      192:+pdVJZVlRZZ1JhAYsk4Ik0gIIE4wUITy+WEgaIu2Uj6IjZqy/WT9TD55R2M:d

    Score
    10/10
    gafgytbotnetdefense_evasiondiscoveryantivm

    • Detected Gafgyt variant

    • Gafgyt family

      gafgyt

    • Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks