Extracted

• • Target

    gtop.sh

  • Size

    2KB

  • MD5

    86a38b2232fb245168b14b395a3a882b

  • SHA1

    600efb77bf03419327d1830ca94863896c30a26e

  • SHA256

    ca881068a55c9fed005fa8d435627ba94cfc32c1b713bda857d4e3db269b64ed

  • SHA512

    0278f33ce19f28cd5d098e0b12b6a1acf30f73c8f6911a6f51d2150798040fec35e2e2ecdc005b85a8556e4652308c9fd36fec5beb2aab2355704054c3647ede

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4