gafgyt | 4c9fbc49a110945822d0417d93159ff42700db00783697b500174b7d3fb9a8e3

General

Target
SnOoPy.sh
Size 2KB
Sample260930-xta29axx8n
SHA256 4c9fbc49a110945822d0417d93159ff42700db00783697b500174b7d3fb9a8e3
MD5 43b62cb5a0ef04c4b4a4693680ca1de0
SHA1 1f4a82be0edfafcd4637c234434e654305198b7b
SHA512 2bd82819b5187ecbb456b86ae57dcea856f33bae0816996477aaf4b50c45776d8319de6e80af050176363a52a21018a63f375da17b425bf010f7e1bf9f3057ec
TLSH
T1C14108C6E1925CF16CA5D51733F9844030D0A0CEA5CA6F0EADDEBBE94C8DDC86A05683
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

gafgyt

C2

176.65.139.151:839

Targets

- Target
  SnOoPy.sh
- Size 2KB
- SHA256 4c9fbc49a110945822d0417d93159ff42700db00783697b500174b7d3fb9a8e3
- MD5 43b62cb5a0ef04c4b4a4693680ca1de0
- SHA1 1f4a82be0edfafcd4637c234434e654305198b7b
- SHA512 2bd82819b5187ecbb456b86ae57dcea856f33bae0816996477aaf4b50c45776d8319de6e80af050176363a52a21018a63f375da17b425bf010f7e1bf9f3057ec
- TLSH
  T1C14108C6E1925CF16CA5D51733F9844030D0A0CEA5CA6F0EADDEBBE94C8DDC86A05683
- MD5 SHA1 SHA512 TLSH
Score

10^/10

botnet defense_evasion discovery gafgyt
- Detected Gafgyt variant
- Family: Gafgyt/Bashlite
  IoT botnet with numerous variants first seen in 2014.
  botnet gafgyt
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detected Gafgyt variant

Family: Gafgyt/Bashlite

File and Directory Permissions Modification

Executes dropped EXE

Reads system routing table

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4