gafgyt | 13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18

General

Target
Sakura.sh
Size 2KB
Sample251204-hml4ls1ldy
SHA256 13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18
MD5 6bbf3b5eabf62b9c6eed0ebfa93a3e3d
SHA1 9387b7ef33c278cd069c8dd8a585be16e72d850d
SHA512 8c714789876eb29980a4a634cb83552bc331644f06f7f9f2e215990db4821ed9c073eaa4aa44b7bf734e6f7c989bcc508a176f23752acddd0e89b4e877c120a0
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

gafgyt

C2

151.244.72.224:606

Targets

- Target
  Sakura.sh
- Size 2KB
- SHA256 13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18
- MD5 6bbf3b5eabf62b9c6eed0ebfa93a3e3d
- SHA1 9387b7ef33c278cd069c8dd8a585be16e72d850d
- SHA512 8c714789876eb29980a4a634cb83552bc331644f06f7f9f2e215990db4821ed9c073eaa4aa44b7bf734e6f7c989bcc508a176f23752acddd0e89b4e877c120a0
- MD5 SHA1 SHA512
Score

10^/10

botnet defense_evasion discovery gafgyt
- Detected Gafgyt variant
- Gafgyt family
  gafgyt
- Gafgyt/Bashlite
  IoT botnet with numerous variants first seen in 2014.
  botnet gafgyt
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detected Gafgyt variant

Gafgyt family

Gafgyt/Bashlite

File and Directory Permissions Modification

Executes dropped EXE

Reads system routing table

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4