Overview

overview

10

Static

static

10

13a9cc2ed1...a842de

debian-9-armhf

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    13a9cc2ed1c1b6eb293cf783b6a842de

  • Size

    211KB

  • Sample

    231219-2gx4gahehn

  • MD5

    13a9cc2ed1c1b6eb293cf783b6a842de

  • SHA1

    5608fff3f53ac90e480b3d58cac93b32dd4d3e0d

  • SHA256

    98b2cbf8c9982833a9818f2eb933d47b5547ecca611faf7a65d3819efcec4c16

  • SHA512

    7568ed58e0dab684122c8269d8bf282f33243209f24ca62b4ffcc1ca54ca4ba9435f13eeb940097ee15f06caf917169190f7080a8b49316eb4900ac2a35d1970

  • SSDEEP

    6144:jg3US/95akNOHY9Ov1I0xD/+/SGM/9IRWmvt24yFJkWXi:jxS/95akNOHYQKKaSn/MWmvt24UJkWXi

Score
10/10
gafgytdiscovery

Malware Config

Targets

    • Target

      13a9cc2ed1c1b6eb293cf783b6a842de

    • Size

      211KB

    • MD5

      13a9cc2ed1c1b6eb293cf783b6a842de

    • SHA1

      5608fff3f53ac90e480b3d58cac93b32dd4d3e0d

    • SHA256

      98b2cbf8c9982833a9818f2eb933d47b5547ecca611faf7a65d3819efcec4c16

    • SHA512

      7568ed58e0dab684122c8269d8bf282f33243209f24ca62b4ffcc1ca54ca4ba9435f13eeb940097ee15f06caf917169190f7080a8b49316eb4900ac2a35d1970

    • SSDEEP

      6144:jg3US/95akNOHY9Ov1I0xD/+/SGM/9IRWmvt24yFJkWXi:jxS/95akNOHYQKKaSn/MWmvt24UJkWXi

    Score
    9/10
    discovery

    • Contacts a large (68447) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks