Extracted

• • Target
    bash.elf
  • Size 109KB
  • SHA256 9f27bc2b0bc6f35c1b1a282b90eb5632fdb11414865bb73a86279843aa845894
  • MD5 0f9d214d2bad723be84f86306fe54731
  • SHA1 81560787041b581ef3b14aa6daefd3e355b3d6dd
  • SHA512 e3d13489796d68aed86810791694175c411151903b81cc3b3c8db1dd7acd5678f6156475faf53da1ec964e448c780b4dac7e727180fe556fbdb8af036ed26881
  • SSDEEP 3072:YHCtzPUmSKzUtiFidYe3KpXXeTZksFDaSo4XRZhSvn:NwKzUti45K1eFkQDaSo4XRZhSvn
  • TLSH
    T154B339CDE640D977D58319B6D29787234172FA36191ACA05F3CBFCB0AA25184B221BED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutiongafgytpersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1