Extracted

• • Target
    Sakura.sh
  • Size 2KB
  • SHA256 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6
  • MD5 c99f1314ea1b13dcaef2e2bc74a808b9
  • SHA1 db15c5ad189e8f1bf664e01c5cfaac846ce5aa5c
  • SHA512 2c2a2c84a56021edd114274646490f95ec2652d3b162fc95c4156c6fd8e3be7af2192feb45243e75e089c4a6ffe354127ff56ff4c9660bc050cadb8b6637b838
  • TLSH
    T1624149D721950FF32C90D93B32798490F5D1A19A95C75F4669DC3CE448BEEECA844682
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoverygafgyt

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1behavioral2behavioral3behavioral4