gafgyt | 0340ac49b3ffa9b62521f5d0ab751b8b1196e816d644317e7ae7a6166b08eb08

General

Target

bins.sh
Size

1KB
Sample

250227-apseeayqw3
MD5

ddd2066e9b68c51382870956a3c59979
SHA1

ce1c982d1e45284c841358935022612c1708822c
SHA256

0340ac49b3ffa9b62521f5d0ab751b8b1196e816d644317e7ae7a6166b08eb08
SHA512

62c1588cc5a05de7b0b6c960ae65e6c9949e15ba7310344e90dc43cfd0fe2a277796bd167fc0eb8ddb0853c2ef556bb6bd648f672491249ccc26c85967e2182b

Score

10^/10

Malware Config

Extracted

Family

gafgyt

C2

162.0.214.70:1111

Targets

- Target
  
  bins.sh
- Size
  
  1KB
- MD5
  
  ddd2066e9b68c51382870956a3c59979
- SHA1
  
  ce1c982d1e45284c841358935022612c1708822c
- SHA256
  
  0340ac49b3ffa9b62521f5d0ab751b8b1196e816d644317e7ae7a6166b08eb08
- SHA512
  
  62c1588cc5a05de7b0b6c960ae65e6c9949e15ba7310344e90dc43cfd0fe2a277796bd167fc0eb8ddb0853c2ef556bb6bd648f672491249ccc26c85967e2182b
Score

10^/10

gafgyt botnet defense_evasion discovery
- Detected Gafgyt variant
- Gafgyt family
  gafgyt
- Gafgyt/Bashlite
  IoT botnet with numerous variants first seen in 2014.
  botnet gafgyt
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

File and Directory Permissions Modification

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4