Overview

overview

10

Static

static

10

HEUR-Backd...69.elf

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Backdoor.Linux.Gafgyt.a-2eea767ef6c0abfa080a8455520b7451a10460842383079bb572b8013b055269.elf

  • Size

    124KB

  • Sample

    220831-dda8jahdf5

  • MD5

    5f8f5cb0cda68bfbfa1fec8a1e9c120c

  • SHA1

    4f35edada9fbe6abbe6deffc5cce7f2278735097

  • SHA256

    2eea767ef6c0abfa080a8455520b7451a10460842383079bb572b8013b055269

  • SHA512

    fb971a8cda7f80d0f49739adaa369d68eb6049e7b6aa2a24107af33f35c49f7356bbf8152151746d299a3924c6219f73a77c827de39755ffe5405bf803712fd1

  • SSDEEP

    3072:EXY5gzI24XRFnDjmoRcQeFxfusim3ZOvhzD9oY4giAGaJpP:EXY5BDXR9Jc5Om3ZOJzD9oY4giAGaJpP

Score
10/10
gafgytmiraimirai_x86coronadiscoverylinux

Malware Config

Targets

    • Target

      HEUR-Backdoor.Linux.Gafgyt.a-2eea767ef6c0abfa080a8455520b7451a10460842383079bb572b8013b055269.elf

    • Size

      124KB

    • MD5

      5f8f5cb0cda68bfbfa1fec8a1e9c120c

    • SHA1

      4f35edada9fbe6abbe6deffc5cce7f2278735097

    • SHA256

      2eea767ef6c0abfa080a8455520b7451a10460842383079bb572b8013b055269

    • SHA512

      fb971a8cda7f80d0f49739adaa369d68eb6049e7b6aa2a24107af33f35c49f7356bbf8152151746d299a3924c6219f73a77c827de39755ffe5405bf803712fd1

    • SSDEEP

      3072:EXY5gzI24XRFnDjmoRcQeFxfusim3ZOvhzD9oY4giAGaJpP:EXY5BDXR9Jc5Om3ZOJzD9oY4giAGaJpP

    Score
    9/10
    discovery

    • Contacts a large (69088) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks