General
-
Target
qkdjdjj22.sh
-
Size
1KB
-
Sample
240702-glxchsygnh
-
MD5
536b6c9024361ab349363a6a55c2a2b8
-
SHA1
d0aec54b19e3e9c9cd68dafe08c4cb6525d8435a
-
SHA256
ac40e30ea6ab94b1102940d16c575f7c87dbe6335530e37f568c4ac2d967f53d
-
SHA512
731b4d784a0b56464dba291fd0e43ee4f99cb2457c54cb91af21ee4c339aecc204c8a9dd592ba87017657752fdcbc6d4b6856f01dbbceefebcfc27affc673954
Static task
static1
Behavioral task
behavioral1
Sample
qkdjdjj22.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
qkdjdjj22.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
qkdjdjj22.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
qkdjdjj22.sh
Resource
debian9-mipsel-20240611-en
Malware Config
Extracted
gafgyt
195.85.205.47:777
Targets
-
-
Target
qkdjdjj22.sh
-
Size
1KB
-
MD5
536b6c9024361ab349363a6a55c2a2b8
-
SHA1
d0aec54b19e3e9c9cd68dafe08c4cb6525d8435a
-
SHA256
ac40e30ea6ab94b1102940d16c575f7c87dbe6335530e37f568c4ac2d967f53d
-
SHA512
731b4d784a0b56464dba291fd0e43ee4f99cb2457c54cb91af21ee4c339aecc204c8a9dd592ba87017657752fdcbc6d4b6856f01dbbceefebcfc27affc673954
Score10/10-
Detected Gafgyt variant
-
Executes dropped EXE
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder
-