Extracted

• • Target

    wget.sh

  • Size

    1KB

  • MD5

    d9e7bd7c471560f8120f7cfd67218449

  • SHA1

    638024e824acabdf51dfc1d2663ff94637062d56

  • SHA256

    97a2af59e1a0a78f21f585490d487c353ee3cf33beff6a0f0118dba33f1a39b0

  • SHA512

    d05370a9cc8b6caadf6aa7a71ed52dc3f6b0b2bdef67066a04ced589207a103ef04412d4e1afc7e936111bdf3e3e69e4f9ef56810dfb27d42b14f7b86032ee2a

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4