Extracted

• • Target

    d2d1c037dd179c345f4077b9b7ea69ed3cb625ebe7bcdcad6ce6a086e4719c95.sh

  • Size

    1KB

  • MD5

    ea40c6fc574ca6806883d693a8afa0b8

  • SHA1

    ffa5c5e27f079da0e2928b589cd629b24541e0f0

  • SHA256

    d2d1c037dd179c345f4077b9b7ea69ed3cb625ebe7bcdcad6ce6a086e4719c95

  • SHA512

    d548f484d081bcd697c3fc6f677bfdb1a41bfc1ea533d699f272ac73ddcb755489a25f2a9bc20ddae554cfa199dd4afab31c90af655ff3175acd15f529aca0a3

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4