Overview

overview

10

Static

static

10

863809222a...acd396

ubuntu-18.04-amd64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    863809222a4251995f076448a3acd396

  • Size

    140KB

  • Sample

    231220-fq8qnschfj

  • MD5

    863809222a4251995f076448a3acd396

  • SHA1

    957fadc0aa67fd6108cfb6dd994de3d5592ae5ec

  • SHA256

    0763544d14fc47dcfdd1a36398f0e22f50a7b57b893cf263cbed17fc0d78d9ad

  • SHA512

    80e3a30c8662a8d17e3fe1878d08b2aaba309d2c9e84f5a04424dbdcff9855662e989827d106c9523d80f7bfe235f0b1c1b1d6d42e8707ae2cd05724429e125a

  • SSDEEP

    3072:ezwFzskMXc8TfskyCBkIOVPem4MSRMWRqDA6Dcoixgr1TkM3Q:eGMXxJyCbOIdVgDcoixgr1TkM3Q

Score
10/10
gafgytdiscoverylinux

Malware Config

Targets

    • Target

      863809222a4251995f076448a3acd396

    • Size

      140KB

    • MD5

      863809222a4251995f076448a3acd396

    • SHA1

      957fadc0aa67fd6108cfb6dd994de3d5592ae5ec

    • SHA256

      0763544d14fc47dcfdd1a36398f0e22f50a7b57b893cf263cbed17fc0d78d9ad

    • SHA512

      80e3a30c8662a8d17e3fe1878d08b2aaba309d2c9e84f5a04424dbdcff9855662e989827d106c9523d80f7bfe235f0b1c1b1d6d42e8707ae2cd05724429e125a

    • SSDEEP

      3072:ezwFzskMXc8TfskyCBkIOVPem4MSRMWRqDA6Dcoixgr1TkM3Q:eGMXxJyCbOIdVgDcoixgr1TkM3Q

    Score
    9/10
    discovery

    • Contacts a large (71482) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks