Extracted

• • Target
    SativaC2.sh.sh
  • Size 4KB
  • SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
  • MD5 40c0d610792cb03b8dcbda5395fc87d2
  • SHA1 950554588813a8fd150ed0f2197681d1ce07165c
  • SHA512 54c8bce64908bcccb4e6a263ec8f03872c039b25c3256a00daa0386d6de12668b0133a1794456420a249c647586cbc6687c9bde4fa3fe73b661023dbf29b4d29
  • SSDEEP 48:JH56NgMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4i1rYO:JH589nj0cRmZpUBNcTAOs9oQXck
  • TLSH
    T197A13FE770319139A4468D2072BC90D16EBAA49AECC09ECE70526E146D7FCC47F36A73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryantivm

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4
• • Target
    a-r.m-4.SativaC2
  • Size 134KB
  • SHA256 2f5c6c94cc34b38d13d6f6222bb54ca64bb97d3345c9df4b703b43385a8bb47e
  • MD5 bf455d7ad9755a4108dbdbf0363ca9dd
  • SHA1 1871941b511cff63834f1a898b3c7a1aab9765ee
  • SHA512 5292398425a158b171d9dde7106cbb118d18116247a6bba554b89de40cf805f0cb0f2fdde795e88c68303f5ffa4915c20123dd6698b5c704b6a96d11ed94cc9b
  • SSDEEP 3072:cxUWRN0+T7b4m/C+acJp6+NsvfJqlXKjiZnCMhqIFO+:cK3K4m/C+O+WJLjiZn/qIFO+
  • TLSH
    T148D31A5DB440CB23C5D1263AFA9E524833735B65FFEE370699187F343BD26298E2A601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral5
• • Target
    a-r.m-5.SativaC2
  • Size 134KB
  • SHA256 8c2ffc06877098d6202e3a46f23218a74274927cd51b48ca4e3f9feb3a6013da
  • MD5 94ff7908ae6d6384ececb1cd000742ee
  • SHA1 1fc7be44c69a995e4f7aaa42a5c6959a6182f368
  • SHA512 8e16777eaa9d1aa739816020dcdb9ea3fab2bbbc7e054cf74afab104e513983cb1e9a59237e011c48868a15964ca7ceceb07d5fb5f9f3f084e345279ca454b34
  • SSDEEP 3072:wxUWRN0+T7b4m/C+acJp6+NsvfJqlXKjiDaMhqIFO+:wK3K4m/C+O+WJLjiDHqIFO+
  • TLSH
    T1D3D31A5DB440CB13C5D1263AFA9E524833735B64FFEE370699197F343BD26298E2A601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral6
• • Target
    a-r.m-7.SativaC2
  • Size 125KB
  • SHA256 1abaa88dccd65608f8247a88a0faed3bd645fdda15b302bb61ccc8a942eeda20
  • MD5 b95c5485ce366313cacc94a092abc0e7
  • SHA1 928efa2d25c7ebd93216244743b3f71541f82c52
  • SHA512 721b52f0f4b62a5ba80664476b0a827deaa7c9ca2d399e77f18e16f9b6ac5b78a4d9e9298b7bc5e76cc1dcf3fb876b4581d7cd525e1549c279ce524336d38868
  • SSDEEP 3072:FlYJxGsF7jFgc9u8ahV3rxz1zWkiPDplI2gP:FuJxrXgc9u8ebxQkiPPI2gP
  • TLSH
    T164C3195DB440CB62C5D1263AFA9F424833735724EFEE370699186F383AD752A8E3A705
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral7
• • Target
    a-r.m-8.SativaC2
  • Size 227KB
  • SHA256 0f50037a4a75241877efc3b33f243a4239995049fd459fff2b455dac8d33f300
  • MD5 f24bf31674a00940cb5090dbc80f4caf
  • SHA1 113334c819fb6d99f2b9329143c5275c85f5c1a1
  • SHA512 947101ce9fe73fda4e371e292970931bd7a97492805a6930dff956225e7f1f852663915a85f2f4648c6fbdd34cd4abc8a49533f57b2569440fcce2fc5c1f1fad
  • SSDEEP 6144:w0c8M+ykO9ptKJZHQWCcLohjE0C5bxbeP4l:ascsxQWCMoh21bI4l
  • TLSH
    T1E4348E48BB4CEB06C0A083FB9D5F0723633134517B8A9B227919662EFDD27DC8C5665E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral11behavioral8behavioral9
• • Target
    arm64.sh.sh
  • Size 579B
  • SHA256 5ca3b37534c5e8cc4bae90be04bcc719d287293e286b70e4f25231748d80c06e
  • MD5 89dcad68f5b7c550376c890eaf656230
  • SHA1 946d09448fca726ac4ab3c617a7d0d916809f33e
  • SHA512 a3c999118b8843f99857205887d79d2e2d1911d1ae7bda7a225c2e0aaa339fcaf4e8f3536bbfdab404f86dd47d8609abe68a5859880362b2c100b2ea5bc06c8c
  • TLSH
    T1BDF0F6EAA1A31C3A7C458E2531EC14F19A98A4B79CE09E0FA4052DD0F80EF04FA65633
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiongafgytantivmdiscovery

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  behavioral12behavioral13behavioral14behavioral15
• • Target
    m-6.8-k.SativaC2
  • Size 121KB
  • SHA256 55f400523d42b6e42c1084eae678651530884696c716fdef704f097e8df7842d
  • MD5 b1bbb5555e726a7c3642e16b89c616bc
  • SHA1 67049899ed23da15ac8318979e2d7f2dbc36b0f9
  • SHA512 e2b7da2e17970bf4f15af3fa984cdb0649329f7e60db005185bf317ead8ce67485f9aca1d0d29d7dd1e975647af9488ac2475ecec068d0006c717f3a65951ff8
  • SSDEEP 1536:FroaHzArCerO7ExptcSyAiWXJBC3v43JFg3sonBH074/N9h46yasQrAiXxIYBE8+:ZOrhtcSy8C3vMghBc4/V7soAZbU5ecB4
  • TLSH
    T124C38F91735D3D6FC1B69E3A8483C3027F24EE10AA462613507DB7572EB32E11E6B6C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral16behavioral17behavioral18behavioral19
• • Target
    m-i.p-s.SativaC2
  • Size 187KB
  • SHA256 81d7f5ce799c3e86bc6e23eec6c1e1073c108e88551af7aca6e87de406698333
  • MD5 21ea0ee841b8eced252e169843de7a32
  • SHA1 eeb9bf578edcd9cfc97dd35cb16409affcee6118
  • SHA512 284fb336eeb62856d5c82037c59eed5179bff4877bfbe1f91c85a841dfa1fd844bd129abca5736635027a10997bf763b1b8f615ff69486cde6b612b77ea2b235
  • SSDEEP 3072:hM1ey7JnonhectCLu3rVCRC92sAnG41pfC/hjgbltd651R3tbTgERy:hM1eeocADw4KG4E9x5btngERy
  • TLSH
    T108142A567B11AFA2C228C53009F3C35267F636D227D29549B26DDB187E213496C2FFE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral20
• • Target
    m-p.s-l.SativaC2
  • Size 187KB
  • SHA256 2761b6fec6aadf449090548926dd50e2de093cab254c97394eb350a226ab3054
  • MD5 06fe3711f4526295fab9589005d887a5
  • SHA1 9ea657de578ffcbd8efa875e604d19e24aaf36f4
  • SHA512 80bf0b676ac7e477b9ebe262d4fe96f5df4418038fb7e6126889de0874f24c7c447195dfdb085c33692a9d635ee0d97b8b1d951ad33c815c1c02dfddc47de920
  • SSDEEP 3072:0K1DpxJQhvn4L32bo97xrspaW16Xch6Ft1LpqVgbs+UcgAn+jtbTgE:0K1zWhS2bi7lCaW16XcctLxIvtjtngE
  • TLSH
    T10E144B46BF505FEBC05ECF31066B831213E9D88653AA6B2E717C9A9C3D5A3494DC3AC4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral21
• • Target
    p-p.c-.SativaC2
  • Size 171KB
  • SHA256 f9ad742f2618ecff013631ec4d08ee614065018c38430a522028996d990ef845
  • MD5 c781fd476f35cbb56021b6440ef6ac3b
  • SHA1 4afcded6378f1df5e79f392984c64afd9f6fe736
  • SHA512 25b482c64e7f1928fe2315cec1440235e498e1eb750ed8000bf3470b47a5b9e8699a960636ee06452c487188d06ad49d43b1283925f8bf01f86a67c80ef5708d
  • SSDEEP 3072:ygn4EaDryGygTACTzx5woZJKkSmb+T5BKl4EomRPcP6u/GZXxE:hn0rJPNTz/woZJKkSe0um466u/mXxE
  • TLSH
    T1F5047D11FB1C1553C0821E705E3B0767A336958186B9E60E660D7F2A2B33AF64E877ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral22behavioral23behavioral24behavioral25
• • Target
    payload.sh.sh
  • Size 4KB
  • SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
  • MD5 40c0d610792cb03b8dcbda5395fc87d2
  • SHA1 950554588813a8fd150ed0f2197681d1ce07165c
  • SHA512 54c8bce64908bcccb4e6a263ec8f03872c039b25c3256a00daa0386d6de12668b0133a1794456420a249c647586cbc6687c9bde4fa3fe73b661023dbf29b4d29
  • SSDEEP 48:JH56NgMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4i1rYO:JH589nj0cRmZpUBNcTAOs9oQXck
  • TLSH
    T197A13FE770319139A4468D2072BC90D16EBAA49AECC09ECE70526E146D7FCC47F36A73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryantivm

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral26behavioral27behavioral28behavioral29
• • Target
    x-3.2-.SativaC2
  • Size 119KB
  • SHA256 779ff6d3f2d459a2fd99df9b3136612da7a8d4f73a74e2d5fb45709255f9616a
  • MD5 053cdb305b0187d256d15383e9ae87dd
  • SHA1 78ae9d0b0be6360f145ea582331bd38abba7da1d
  • SHA512 43a0022dfc88a1740e315b0558a1c27c8f3f7cde90746ae95eff479bb6c81bc6bb24996d9d985cfaa96f9cc672e1cf3103c19c0fbbf6df111c17528762c3c5e6
  • SSDEEP 3072:C7wqc7cLMU21kvbtalPTqU3AIgfDjhPAdcA:CZcjkTy2U8L9PAdcA
  • TLSH
    T125C37B85F783C1F3E5830673056BDBAA4B31DD25420ADF46FB0E7A656D7260A8C5A32C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral30
• • Target
    x-8.6-.SativaC2
  • Size 105KB
  • SHA256 77a88c19c58a48b22835c796fbd97471b891c6aeeb159c023a80912b7c3d6096
  • MD5 45c93111ed9f802433768dfaae978002
  • SHA1 a8174ea072d295075d65356fa788c7e84c28bf58
  • SHA512 fcdc18b20faa2dde1ff3def57ca51534e651c8e378218d6561d1a25f4e6f3dfdae0955958f0033db0cd6584ca73d9f1e6aef2256647dc74e0d4124230013a93e
  • SSDEEP 1536:Mr32xQzMb0BwHGyD65xFcQMHKJMA81CJcApZbUW/cO0EnMorBaqto0+dzSFzpG4o:MGxQgxmVxdMHuNJhbbOO99UqtOKpG4o
  • TLSH
    T13AB34B02ADA1C0FEC0D6C53597DBD222F732BC5553117B2B3394AA353FA2F691B09658
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral31