Overview

overview

10

Static

static

10

x86.elf

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x86.elf

  • Size

    113KB

  • Sample

    230321-j4zxgabc8s

  • MD5

    79cfa8e4ba19369308161188c8cdd61b

  • SHA1

    e090129823d66f22d019bd43472ecaa92a159991

  • SHA256

    b879b68e9829dff8209629afd872380a81f88a5acb16de10c97f7a0e75ee95a5

  • SHA512

    10675f0b233c09a2bb8c8e2265b5d52e8f7adac193f7fb74c992458b43e8f0b4b573f6a49dbaed64f079fa4643638bd55d53523d1c4928adad08321088674003

  • SSDEEP

    3072:CirOU8Ec6uPd0YqtxjlRt6l+eJg+dm7FnVqfJXFWbNb:IEc5bqtxrSg4m7FnVqfJXFWbNb

Score
10/10
gafgytlinux

Malware Config

Targets

    • Target

      x86.elf

    • Size

      113KB

    • MD5

      79cfa8e4ba19369308161188c8cdd61b

    • SHA1

      e090129823d66f22d019bd43472ecaa92a159991

    • SHA256

      b879b68e9829dff8209629afd872380a81f88a5acb16de10c97f7a0e75ee95a5

    • SHA512

      10675f0b233c09a2bb8c8e2265b5d52e8f7adac193f7fb74c992458b43e8f0b4b573f6a49dbaed64f079fa4643638bd55d53523d1c4928adad08321088674003

    • SSDEEP

      3072:CirOU8Ec6uPd0YqtxjlRt6l+eJg+dm7FnVqfJXFWbNb:IEc5bqtxrSg4m7FnVqfJXFWbNb

    Score
    9/10

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks