Extracted

• • Target

    e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh

  • Size

    2KB

  • MD5

    87a7140288b8fc77f9917199d1c969bb

  • SHA1

    0931d942a8cc6f317b24082900bd24ec697a697e

  • SHA256

    e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f

  • SHA512

    2cdebd869d0cd7f590f050fe987af0ff80592646cdaaff83b7b78f07c8328401c87bd4b8d072dd87ef26de619a2ec7e06ad7e61204371e93e21a1835f23097f7

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4