Overview

overview

10

Static

static

10

9702dc811c...c7.elf

debian-9-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf068be65e5cde6c25feb311671b0f30.bin

  • Size

    50KB

  • Sample

    230404-ce9l2scd26

  • MD5

    0d956ebb86f97d2d792cd39d6ea3b85a

  • SHA1

    da601d67df333f8000415754f49e94f5a6faf7e9

  • SHA256

    6c0cf5bf050c6980317757953f25a6595b8428709df3583a5e767da26f25c510

  • SHA512

    0a7d0ff2bea5b97b6c8b8f858d6a22f213349ee8f0695297a8f404d36c2afc686578a640e16ee10cba9bc11c306a482a0e2f0bc717c3848581dc8416b5aa79ab

  • SSDEEP

    1536:NVMZmLD4nc9rkDxCfND0WcH1pP66ZDiGuHXNVzXIUmpq1c:jmFnnDsfNFcny6ViG2XNPmpSc

Score
10/10
gafgyt

Malware Config

Extracted

Family

gafgyt

C2

43.153.37.45:707

Targets

    • Target

      9702dc811c05ceb5a80b465c966ab392dde2bf6442f59b8dddf1b5106577b1c7.elf

    • Size

      112KB

    • MD5

      cf068be65e5cde6c25feb311671b0f30

    • SHA1

      2cd3dbfd02f0964e589050c8ce5df06c2eb5dbf3

    • SHA256

      9702dc811c05ceb5a80b465c966ab392dde2bf6442f59b8dddf1b5106577b1c7

    • SHA512

      f7bac552eb96984669ee1e82bc8a978e6ca3ac7366c4664ae36c0a71eed03e72b427b19197cad635104e4fec6c27a29611380ee0a4d1fce77c028cc3f89b1dc3

    • SSDEEP

      3072:Ld5aPO2ONvarAJy9n5h/8KkGdAQvkbmOQUJ1UXpTn:Z5aPO7s9n5h/8KL2QcbmOQUJ1apTn

    Score
    7/10

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks