Extracted

• • Target
    exodus.sh
  • Size 813B
  • SHA256 bcde5249b6e351e8beacc988662c77435803709d4de448daf21d8c1d9506dd79
  • MD5 49960a49dd630edb1e0118fb926212a8
  • SHA1 a2de17330c8b88d5faae0db58b3652deaf2fdc7f
  • SHA512 c8edc93e759aaaf18dfe547ac7086a2951430fc5296f024d02d30311c18f7f4a5b3ffb9d05971b55ccba0390a7de32bf3e8a9a46bf68ad215958c209c04d5303
  • TLSH
    T1730186C51585B073C9F8DA2578518ED0710823B9E8DD293CDDD4746B9D9662CBC1BB07
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverygafgyt

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4