Extracted

• • Target
    a-r.m-6.Sakura.elf
  • Size 290KB
  • SHA256 04836eb5ae02af23228dce6fcf4bc89e260a06564dcfd05aa2eb0706e71d9394
  • MD5 8c6e6f70da716a8667c5da24b8c6a93b
  • SHA1 a1d475aa15f332af0d1ce08a6aa6ba90fb3be8e4
  • SHA512 fe8a7eaef7d4f84820fcbe9da9cef29244bf05e073bc308c9933281e385c75440a9d6a726d561981417e35a9d6857cf66e1fc43a692ae264c74da2d5884218de
  • SSDEEP 6144:/vTr/EZfhf5qMOyoaAasl2/8j1yhFFSx5w+twifIDxLC6Wm+litZE0Lh9iSG6:/3/iJRDAasNuFFa5w+tw7w6Wm+lity0J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gafgytbotnetcredential_accessdefense_evasiondiscoverypersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Gafgyt family

    gafgyt

  • Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • OS Credential Dumping

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes DNS configuration

    Writes data to DNS resolver config file.

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence
  behavioral1