Overview

overview

10

Static

static

10

2ef0a31113...df6f14

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ef0a31113cff263cd19f3833adf6f14

  • Size

    111KB

  • Sample

    231219-2s8z4sebal

  • MD5

    2ef0a31113cff263cd19f3833adf6f14

  • SHA1

    01361f04eb18d51614bd350781ed1072cfadd698

  • SHA256

    1278ce50af515e44a20bb4cbb61ad9ff3b5974f2145486b9b16f7067458ec17f

  • SHA512

    7de8574e482c1d0c03f3ef1a086308eccd0a84b7210a1c8b73c54698255e52725d08b16068a8dad645001be8dbb4b83b2600355934b7a44d8affc96c8a39e91c

  • SSDEEP

    3072:ok2jYylW7AnE3gGWzw9VyxnSbjlmqKkcLJSYnLj9:opv0GqRyxnSbJmqKkcLJSYnLj9

Score
10/10
gafgytdiscoverylinux

Malware Config

Targets

    • Target

      2ef0a31113cff263cd19f3833adf6f14

    • Size

      111KB

    • MD5

      2ef0a31113cff263cd19f3833adf6f14

    • SHA1

      01361f04eb18d51614bd350781ed1072cfadd698

    • SHA256

      1278ce50af515e44a20bb4cbb61ad9ff3b5974f2145486b9b16f7067458ec17f

    • SHA512

      7de8574e482c1d0c03f3ef1a086308eccd0a84b7210a1c8b73c54698255e52725d08b16068a8dad645001be8dbb4b83b2600355934b7a44d8affc96c8a39e91c

    • SSDEEP

      3072:ok2jYylW7AnE3gGWzw9VyxnSbjlmqKkcLJSYnLj9:opv0GqRyxnSbJmqKkcLJSYnLj9

    Score
    9/10
    discovery

    • Contacts a large (23840) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks