General
-
Target
1bc971b3048142bf4582baddd7d51fd2.elf
-
Size
192KB
-
Sample
230426-mfczksgf84
-
MD5
1bc971b3048142bf4582baddd7d51fd2
-
SHA1
a8182cc6ca180dd57f55026e428f62725e99cd70
-
SHA256
7d97f841f751fc60aeab86eb617d75c3c7eb184078dbcfeafc592487cc536ddb
-
SHA512
af256ddb7d7381cc3bfa72eeadfc077a65cd0dd142b8ebe6712e8a6bd9dd50355e3d735a66c0fe16c9fea3308ccc9464e9aa1a3d61ae09e8c87592bd1ae73d4a
-
SSDEEP
6144:VT+saOVM0GeELIXeCCT10q3DnM/9Jrm17L4X5LW:VCsaOVM0GejOX0oM/Prm1/4X5LW
Behavioral task
behavioral1
Sample
1bc971b3048142bf4582baddd7d51fd2.elf
Resource
debian9-armhf-20221111-en
Malware Config
Extracted
gafgyt
47.87.161.172:6580
Targets
-
-
Target
1bc971b3048142bf4582baddd7d51fd2.elf
-
Size
192KB
-
MD5
1bc971b3048142bf4582baddd7d51fd2
-
SHA1
a8182cc6ca180dd57f55026e428f62725e99cd70
-
SHA256
7d97f841f751fc60aeab86eb617d75c3c7eb184078dbcfeafc592487cc536ddb
-
SHA512
af256ddb7d7381cc3bfa72eeadfc077a65cd0dd142b8ebe6712e8a6bd9dd50355e3d735a66c0fe16c9fea3308ccc9464e9aa1a3d61ae09e8c87592bd1ae73d4a
-
SSDEEP
6144:VT+saOVM0GeELIXeCCT10q3DnM/9Jrm17L4X5LW:VCsaOVM0GejOX0oM/Prm1/4X5LW
Score7/10-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-