Overview

overview

10

Static

static

1

curl.sh

ubuntu-18.04-amd64

10

curl.sh

debian-9-armhf

10

curl.sh

debian-9-mips

10

curl.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    curl.sh

  • Size

    1KB

  • Sample

    250111-anc84avkes

  • MD5

    d8d6be287e3428bc6eb16a3e05e8ab47

  • SHA1

    c6bba87f1258183e8e70b2ac18dee260c48eb04d

  • SHA256

    72f5f8ec4a91b6d69c3e3be588664aba1c2c511ecdfd8430dc0edf9d1af00353

  • SHA512

    a8a1f7d030459952f7523cdc2345844d3ce1f6da443a302c17b32fc053fe12a36aed91fa507f0575cce11459434224a54bd21bb814606bc964ec9476a549ceee

Score
10/10
gafgytantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      curl.sh

    • Size

      1KB

    • MD5

      d8d6be287e3428bc6eb16a3e05e8ab47

    • SHA1

      c6bba87f1258183e8e70b2ac18dee260c48eb04d

    • SHA256

      72f5f8ec4a91b6d69c3e3be588664aba1c2c511ecdfd8430dc0edf9d1af00353

    • SHA512

      a8a1f7d030459952f7523cdc2345844d3ce1f6da443a302c17b32fc053fe12a36aed91fa507f0575cce11459434224a54bd21bb814606bc964ec9476a549ceee

    Score
    10/10
    gafgytbotnetdefense_evasiondiscoveryantivm

    • Detected Gafgyt variant

    • Gafgyt family

      gafgyt

    • Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks