Behavioral task
behavioral1
Sample
045a0e109d566f27021ab20aa6c7ceb29895a5b8512f5de0c4bdc4282971e5f9.elf
Resource
debian9-mipsbe-20230831-en
debian-9-mips
2 signatures
150 seconds
General
-
Target
8d4ca7ee2e6b7933c6144c2b01e9c1ac.bin
-
Size
44KB
-
MD5
3b18b03fc29b64ee22acfef674921af4
-
SHA1
644fdf7f9172fcb2ffa9089df93e23f6645d9c5d
-
SHA256
706148410c1411f7a24f5914afb7339eb28aea59f8e6ef4d243bffc8d75a5f94
-
SHA512
3e7a4d38337287a806e09b8f8a950feed71ec13c5da0664a3db008764e499323f160ad04afa248c41f35ca0e9bd7ab702cbc5d44403d6689b859de3c3ae6815e
-
SSDEEP
768:v69WsdQr8EAMvW6XKt+9s+6w5I6tebG/7c8X9Y2gD2A62Y3/yQU5rs28Tj5F+gxN:YQrrAf66tcKw55/7D9I2A62YqJSj5EsN
Malware Config
Extracted
Family
gafgyt
C2
45.61.184.126:2782
Signatures
-
Contains strings common to LOLSquad DDoS tools 1 IoCs
Resembles a range of public tools written in C intended for DDoS attacks.
resource yara_rule static1/unpack001/045a0e109d566f27021ab20aa6c7ceb29895a5b8512f5de0c4bdc4282971e5f9.elf lolsquad_ddos -
Detected Gafgyt variant 1 IoCs
resource yara_rule static1/unpack001/045a0e109d566f27021ab20aa6c7ceb29895a5b8512f5de0c4bdc4282971e5f9.elf family_gafgyt -
Gafgyt family
Files
-
8d4ca7ee2e6b7933c6144c2b01e9c1ac.bin.zip
Password: infected
-
045a0e109d566f27021ab20aa6c7ceb29895a5b8512f5de0c4bdc4282971e5f9.elf.elf linux mipsbe