Overview

overview

10

Static

static

10

f91d9aa9e9...19.elf

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f91d9aa9e9d29ae67a5d1d504050c519.elf

  • Size

    151KB

  • Sample

    221130-afgasaec8x

  • MD5

    f91d9aa9e9d29ae67a5d1d504050c519

  • SHA1

    aad17596d13e5d9439141165e968f9001af29407

  • SHA256

    b49d71d61bc5f0871a7fa5f4cb6816d9a58633440428a3ddec13346fd4386185

  • SHA512

    3293e2e6546b811a160a0cf204d955623f4c2e0ac7893ffafb6e114aca53b41a334875715ab12dac5512d98b298632e15e946fa890a453a3cb566b5420cd5c05

  • SSDEEP

    3072:JW6dK9tS1aRGQdK76t/zLEI5mrThPaLEnvPrNb:c6UG+LL5mrThPaLEnvPrNb

Score
10/10
gafgyt

Malware Config

Targets

    • Target

      f91d9aa9e9d29ae67a5d1d504050c519.elf

    • Size

      151KB

    • MD5

      f91d9aa9e9d29ae67a5d1d504050c519

    • SHA1

      aad17596d13e5d9439141165e968f9001af29407

    • SHA256

      b49d71d61bc5f0871a7fa5f4cb6816d9a58633440428a3ddec13346fd4386185

    • SHA512

      3293e2e6546b811a160a0cf204d955623f4c2e0ac7893ffafb6e114aca53b41a334875715ab12dac5512d98b298632e15e946fa890a453a3cb566b5420cd5c05

    • SSDEEP

      3072:JW6dK9tS1aRGQdK76t/zLEI5mrThPaLEnvPrNb:c6UG+LL5mrThPaLEnvPrNb

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks