Extracted

• • Target
    bash.elf
  • Size 109KB
  • SHA256 f64e69b29a732cad6a023c77ba8dff6bd35fc0afef35364b367e6cd30f4b216b
  • MD5 3aca8a0e2a1ce31cad826855ee3cebd8
  • SHA1 204d2a2f0fd3a78f19f03e52a0dab02752093d00
  • SHA512 d37d8e870f08b2946e438ce6ccbbd84d921f6e0c27143a2d926b00dc8ff2ab1fcd1c9618ffbb0d3d0265b23bd9a39f0f21da895c8435cbf833ce007d1fdbbd45
  • SSDEEP 3072:YHS9r0UVKOtvsad4m3KkXP+jZBHDaSo4XRZhSvn:9KOtvPxKC+1BHDaSo4XRZhSvn
  • TLSH
    T11BB33ACDE740D577D58319B2D29787234072EA361A1ACA05F3DBFCB4AB25184B221BED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutiongafgytpersistenceprivilege_escalation

  • Detected Gafgyt variant

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Schedules an At job

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation

  • Modifies Bash startup script

    persistence
  behavioral1