Extracted

• • Target
    getty.elf
  • Size 85KB
  • SHA256 97d433c19f469b548abdf32a0121b627e51afde5f2e590c52b89cb894874cae9
  • MD5 b282e0a93d164f0ceaaa86db11ddc55b
  • SHA1 826d2f7dc31cd6c975af89c7ffce6e4d7ae58f17
  • SHA512 537de6a33f38c5b29b2587358dbb73e48f456fd59417dc418ae1f184f82d4b9aa856749dff9104b42a01bd227aa2778db2a3b36c5d9c59e06f71f801636bfecc
  • SSDEEP 1536:JKzaD1BEzNAsWZE9dwOx5MBGqHgPyUwYKXy7ZDdyDoPO/fPAn/fFXn:71BEse9WOx+8qyhwxylDADuO/fPk/fF3
  • TLSH
    T133833AD6E643C6B7C8870BB103B7EA3A1522B83B0B1ADE05F7287CB49B674C87125755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutiongafgytpersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1