gafgyt | 619bbd3738ed3305fff431c1d0af3bb9[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

619bbd3738ed3305fff431c1d0af3bb9.bin
Size

49KB
MD5

77880fcbea64f10313f9560b304fc7de
SHA1

20f055d0122766b793c1bde7b8d6b8f0ac4cb73a
SHA256

1b58487784d99ecca41923afe079e29ad9a9b54608b643c095fb749456151d8a
SHA512

065cf929c38197c84ff53be1be6ff41b3bbfee4968c46339b943134f6dca217184ae3f0768e3c174fb5cdd6b1ad027d77ddfe6147855e8086445c82af35745a4
SSDEEP

1536:029nkCs1lZgPTib8DCQOAIeCsEt2yvwIm:03R1web8+rsym

Score

10^/10

upx gafgyt

Malware Config

Extracted

Family

gafgyt

C2

193.35.18.187:64599

Signatures

Detected Gafgyt variant 1 IoCs

resource	yara_rule
static1/unpack001/c709df76fa0db8c6bddc60c2f0f9ab02fe4cd4af4634023fa22f4ac321d0b384.elf	family_gafgyt

Gafgyt family
gafgyt

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/c709df76fa0db8c6bddc60c2f0f9ab02fe4cd4af4634023fa22f4ac321d0b384.elf	upx

Files

619bbd3738ed3305fff431c1d0af3bb9.bin
.zip

Password: infected
c709df76fa0db8c6bddc60c2f0f9ab02fe4cd4af4634023fa22f4ac321d0b384.elf
.elf linux