Overview

overview

10

Static

static

10

720bba8499...65f9f6

ubuntu-18.04-amd64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    720bba8499e21988019211d4b265f9f6

  • Size

    98KB

  • Sample

    231220-af4q3sahgn

  • MD5

    720bba8499e21988019211d4b265f9f6

  • SHA1

    2c3024a3b381bc76ac05591eb6bafd97413d0371

  • SHA256

    261202a403c9177eaf58331dc0c386158b24fa1f5365e13de4ab374b10efdb8b

  • SHA512

    4207be23913c27ea4a76e73470e5567f415089d356c137692f9820f665b92b3506ab550886bfe9ded0d23835ec930ba133f1c795338ae1f5dc168ccc695d6b33

  • SSDEEP

    3072:he7EqekUHfPyjRJ9rBFKqk2F1QmqoVcqq6GnQOT:heZyo5Kqk2PQmqoVcqq6GnQOT

Score
10/10
gafgytdiscoverylinux

Malware Config

Targets

    • Target

      720bba8499e21988019211d4b265f9f6

    • Size

      98KB

    • MD5

      720bba8499e21988019211d4b265f9f6

    • SHA1

      2c3024a3b381bc76ac05591eb6bafd97413d0371

    • SHA256

      261202a403c9177eaf58331dc0c386158b24fa1f5365e13de4ab374b10efdb8b

    • SHA512

      4207be23913c27ea4a76e73470e5567f415089d356c137692f9820f665b92b3506ab550886bfe9ded0d23835ec930ba133f1c795338ae1f5dc168ccc695d6b33

    • SSDEEP

      3072:he7EqekUHfPyjRJ9rBFKqk2F1QmqoVcqq6GnQOT:heZyo5Kqk2PQmqoVcqq6GnQOT

    Score
    9/10
    discovery

    • Contacts a large (23684) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks