Extracted

• • Target

    Sakura.sh

  • Size

    2KB

  • MD5

    a74c4d7f9905b87261427eebca20609b

  • SHA1

    9b3941f476af0f3661bec0bd4915f8cc6a843179

  • SHA256

    320b20de26db0437f76a3f7f1e7d8980e7fb254534fef0adf7220fe39a85c06b

  • SHA512

    5ee580c525590bf19f2b792d238c3c4a0de25f4c7a118097b0c96fc21ed55c7e6555f3b202cafcd989d4c9cd36bf7e5e545e11bc57ec75a8ddf8770cc4a3a5d0

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4