Overview

overview

10

Static

static

1

wget.sh

ubuntu-18.04-amd64

10

wget.sh

debian-9-armhf

10

wget.sh

debian-9-mips

10

wget.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wget.sh

  • Size

    1KB

  • Sample

    250105-gw2pzsvldx

  • MD5

    3556efaeedbc73136a9b2628ea6002b6

  • SHA1

    2c4795c1553f260dbb662b883dddaae6eee48f54

  • SHA256

    ad54fc11ccdbac99d10fd5c5b38eaaa680677ee3832425f35230fc9ac09b631f

  • SHA512

    7bab0772028c781d292d5676bf57e25f247bde34a4ddc4ac60585db666f7666ce1153eff5db289c85c62e791d3e31aed06d455ff02cae5cc35e9d08e5816117b

Score
10/10
gafgytbotnetdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      wget.sh

    • Size

      1KB

    • MD5

      3556efaeedbc73136a9b2628ea6002b6

    • SHA1

      2c4795c1553f260dbb662b883dddaae6eee48f54

    • SHA256

      ad54fc11ccdbac99d10fd5c5b38eaaa680677ee3832425f35230fc9ac09b631f

    • SHA512

      7bab0772028c781d292d5676bf57e25f247bde34a4ddc4ac60585db666f7666ce1153eff5db289c85c62e791d3e31aed06d455ff02cae5cc35e9d08e5816117b

    Score
    10/10
    gafgytbotnetdefense_evasiondiscovery

    • Detected Gafgyt variant

    • Gafgyt family

      gafgyt

    • Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks