Extracted

• • Target

    bins.sh

  • Size

    1KB

  • MD5

    3fe001266d6743a61f371e35d18a362a

  • SHA1

    63e6fb3e130d0204b47845ea33234d2aebf318de

  • SHA256

    409f0f68302f6d7e81372c924901b89c01d6d64df78dad529e4b5edf2c15b4a1

  • SHA512

    1cb24458f4848eeb53f34e495e0ca349eefaf86082ca024b2f958ed55ad41c2abc4022aee3d4e1e9333cc67f75f274e9090838ba12fb84c42018f9a7ba9dda46

  Score

  10^/10

  gafgytbotnetdefense_evasiondiscovery

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4