Overview

overview

10

Static

static

1

22f0cab894...44cf98

ubuntu-18.04-amd64

10

22f0cab894...44cf98

debian-9-armhf

10

22f0cab894...44cf98

debian-9-mips

22f0cab894...44cf98

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    22f0cab894d583ba3e871a983ffd99c2e84083e8bc555f5663de95ca3844cf98
  • Size 1KB
  • Sample260702-jecqmscs8q
  • SHA256 22f0cab894d583ba3e871a983ffd99c2e84083e8bc555f5663de95ca3844cf98
  • MD5 SHA1 SHA512 TLSH
Score
10/10
gafgytbotnetdefense_evasiondiscoverylinux

Malware Config

Extracted

Family

  • gafgyt

C2

  • 85.204.125.67:12345

Targets

    • Target
      22f0cab894d583ba3e871a983ffd99c2e84083e8bc555f5663de95ca3844cf98
    • Size 1KB
    • SHA256 22f0cab894d583ba3e871a983ffd99c2e84083e8bc555f5663de95ca3844cf98
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    botnetdefense_evasiondiscoverygafgyt

    • Detected Gafgyt variant

    • Family: Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks