Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2584e2dad6a0f9a02d131bbff22711ad.elf

  • Size

    161KB

  • Sample

    230416-kbv89abb5x

  • MD5

    2584e2dad6a0f9a02d131bbff22711ad

  • SHA1

    9863e62bcdd0d9db3361c161f64445d2d51e052c

  • SHA256

    c0c8e830c120c8d6d3dbc5cbafb8b373b46909254826a7ad6486a55b63d5a2e7

  • SHA512

    0a19b59ae56bfcd4060419a3175c05a57e9912f4dc6544ea75190c69827de47c9b65d4dcfa947964bbe8a2e46a7b82e89440199418875fb87fb66a5c5e5181c5

  • SSDEEP

    3072:kc//MM6SLIa5M65etJ8au49QuhsRufcOBGqNjfiUfnLdJiBeGW:kc//WSLIaO65etJ8au4lJnMqNjfiUfnz

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

57.128.168.187:23

Targets

    • Target

      2584e2dad6a0f9a02d131bbff22711ad.elf

    • Size

      161KB

    • MD5

      2584e2dad6a0f9a02d131bbff22711ad

    • SHA1

      9863e62bcdd0d9db3361c161f64445d2d51e052c

    • SHA256

      c0c8e830c120c8d6d3dbc5cbafb8b373b46909254826a7ad6486a55b63d5a2e7

    • SHA512

      0a19b59ae56bfcd4060419a3175c05a57e9912f4dc6544ea75190c69827de47c9b65d4dcfa947964bbe8a2e46a7b82e89440199418875fb87fb66a5c5e5181c5

    • SSDEEP

      3072:kc//MM6SLIa5M65etJ8au49QuhsRufcOBGqNjfiUfnLdJiBeGW:kc//WSLIaO65etJ8au4lJnMqNjfiUfnz

    Score
    7/10
    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

MITRE ATT&CK Enterprise v6

Tasks