Extracted

• • Target

    jackmyx86.elf

  • Size

    114KB

  • MD5

    3653915d5fde38c3a942c8f7f2ee3db7

  • SHA1

    ed26dc0db47db555fd502c252c795e23421e3e6e

  • SHA256

    df374e54f910df6ee0a31fe202876fb2eaec5f8e752eb4e2d067f2ea188a56b8

  • SHA512

    d4349385c308773c64042ef265a470bdb8272da2ab3b19036acc63a064e9bf22915975d2016a59b1d4c46ae4152f8864d3153f041e9e96cb4b122ca9f3f18cc3

  • SSDEEP

    3072:62R082nMp3aD9M0Mmu1vqdR85FqPP3cVOXI+tulD1:6IoumuNfqPP3cVOXI+tulD1

  Score

  10^/10

  gafgytbotnetdiscoveryexecutionpersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Writes file to system bin folder

  behavioral1