Overview

overview

10

Static

static

10

4f1ab4c8ec...484763

debian-9-armhf

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f1ab4c8ec283e0d855d7ad90b484763

  • Size

    135KB

  • Sample

    231219-264ybabeej

  • MD5

    4f1ab4c8ec283e0d855d7ad90b484763

  • SHA1

    13048e8e56f1590f49254e3b3812fc6ddb0cb1b5

  • SHA256

    637897db32a41a813915cba517c2b58712ce3ee972fc5638788ef4096c092d77

  • SHA512

    36a1c6a681fc77f9baff9c39eb46b58a105356ec0a311ebaf147d7d63ea60c18f553baf22fb472dd2c8cd399be94fcbdaeed92454de39eee2fcf025db8143706

  • SSDEEP

    3072:61rFAW6acuV36bzJOVXVsNqorMwEEkmhxQwoV3UNu:OX6acuVVXVsNq1EkmhxQwoV3UNu

Score
10/10
gafgyt

Malware Config

Targets

    • Target

      4f1ab4c8ec283e0d855d7ad90b484763

    • Size

      135KB

    • MD5

      4f1ab4c8ec283e0d855d7ad90b484763

    • SHA1

      13048e8e56f1590f49254e3b3812fc6ddb0cb1b5

    • SHA256

      637897db32a41a813915cba517c2b58712ce3ee972fc5638788ef4096c092d77

    • SHA512

      36a1c6a681fc77f9baff9c39eb46b58a105356ec0a311ebaf147d7d63ea60c18f553baf22fb472dd2c8cd399be94fcbdaeed92454de39eee2fcf025db8143706

    • SSDEEP

      3072:61rFAW6acuV36bzJOVXVsNqorMwEEkmhxQwoV3UNu:OX6acuVVXVsNq1EkmhxQwoV3UNu

    Score
    7/10

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks