gafgyt | 547cede53a86815cdbce364e559f527e71adbed2ceb6c134a8c2a3596f917229 | Triage

Sharing

General

Target

f9600e90885b56ce5020b49e6dc6911c.elf
Size

136KB
Sample

230403-p7hp9age2w
MD5

f9600e90885b56ce5020b49e6dc6911c
SHA1

db8a2357fd829de28004f6e470968acc2db368f9
SHA256

547cede53a86815cdbce364e559f527e71adbed2ceb6c134a8c2a3596f917229
SHA512

9809b4f85a00ac51a032f23beb52cce4dbbdd0f05cbaa60b75fed2d8e5758067662255bde56eab4b9de37f83e6a2af212e170ac699f86a03efb6cda3da523704
SSDEEP

3072:Sdf+fvEqa9FazYA7IboRh4e391CErktmCQA9FX9aH:ifWEqa9FaNh4e3DrktmCQA9Z9aH

Score

10^/10

gafgyt

Malware Config

Extracted

Family

gafgyt

C2

88.208.199.38:23

Targets

- Target
  
  f9600e90885b56ce5020b49e6dc6911c.elf
- Size
  
  136KB
- MD5
  
  f9600e90885b56ce5020b49e6dc6911c
- SHA1
  
  db8a2357fd829de28004f6e470968acc2db368f9
- SHA256
  
  547cede53a86815cdbce364e559f527e71adbed2ceb6c134a8c2a3596f917229
- SHA512
  
  9809b4f85a00ac51a032f23beb52cce4dbbdd0f05cbaa60b75fed2d8e5758067662255bde56eab4b9de37f83e6a2af212e170ac699f86a03efb6cda3da523704
- SSDEEP
  
  3072:Sdf+fvEqa9FazYA7IboRh4e391CErktmCQA9FX9aH:ifWEqa9FaNh4e3DrktmCQA9Z9aH
Score

9^/10
- Modifies the Watchdog daemon
  Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1