Extracted

• • Target
    4bd4048d9a142e204dcabd43d3ef4bacWU.sakura
  • Size 314KB
  • SHA256 143b3cf34928a64d461f3a5d686c825420e9041af251f970258497ab2afd12a2
  • MD5 491a8e4f52c2a21974c4daa037250d9a
  • SHA1 c66258d70ba2f6b53e8c123090e51f4047fdccee
  • SHA512 563bd682618d214f049b953449adf0790d6cafad4ebd2d7cf9bf03210f5c52870ad25411a1ea35352ee3560013abf71a70b3659247be949a6344cad492649a8d
  • SSDEEP 6144:CMBzzAKm2xqa9TV0oaS64nk6+x3OMETeIu+p1pCdrVHL/CxKmFXSmiup5eLny2Ac:rlAvuTV0oaS6J6+x3OMiX1pC/r/iSmiP
  • TLSH
    T107642A08E9405F6BC6E137BEFB9A42CF32335B9877DBB12549385AB433C2B582939511
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetcredential_accessdefense_evasiondiscoveryexecutiongafgytpersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • OS Credential Dumping

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes DNS configuration

    Writes data to DNS resolver config file.

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Write file to user bin folder

    persistence

  • Writes file to system bin folder

  • Modifies Bash startup script

    persistence
  behavioral1