Overview

overview

10

Static

static

10

f42df781c5...d4.elf

ubuntu-18.04-amd64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0795290ee8634caeab4d8c88de21994f.bin

  • Size

    53KB

  • Sample

    230328-bdd83saa3t

  • MD5

    866235d35ed05787428d6698e321066f

  • SHA1

    063bdaf2c3f8795c97fe39286759f523a2a67631

  • SHA256

    b4eef4d7d44e532e496d59d19a5bef4833e4a0b2cbd3884d6378fb9d12bdf193

  • SHA512

    78336780723b4ffbb1c28b1e20dbe3126abc633e652a70de178c37df02d1e300f921aa1b33f775de8fd8452b6fa7b69dca115ec5efa947c7d94757e6613b5500

  • SSDEEP

    1536:2XZfoB38UYgUSiiKXtclum4r5KdTDEgqXTloJF9HsR0:aA3+ccK1qTloJF9T

Score
10/10
gafgytlinuxpersistence

Malware Config

Targets

    • Target

      f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

    • Size

      140KB

    • MD5

      0795290ee8634caeab4d8c88de21994f

    • SHA1

      c0cea0ab841d7178f29aeec95e79e8c6cf0fc0f0

    • SHA256

      f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4

    • SHA512

      5163e56b66854749946e207aced8646207d7f99dd48fb07de3782472ae3160c28c6a54a59e730e6bf2876a5b25d43c7d5c15ec41a91f10ce17488f00d4482642

    • SSDEEP

      3072:K1gdBvfRaBNGYAXXpETbZOutJ8adPF4KQTjsV/43giCDebvfcivGmS+Qk:jaLSX5Y4utJ8adPF4fCqCDebvfci+mSy

    Score
    7/10
    persistence

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

2
T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks