Extracted

• • Target

    c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh

  • Size

    1KB

  • MD5

    bde39538b06d88b7a87b780632cd6cc4

  • SHA1

    2d0b08b406f1f662be79d36d76ebd89be884b78a

  • SHA256

    c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e

  • SHA512

    dbc9926f5cc977914af3e4b701a2ec24b964232cf1781a3b07a0e43ff95692b2c0efb7dfe6bcda37f9d919e66c75bdd2806f907548427b66f28ccf3d0d503c73

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4