Overview

overview

10

Static

static

10

d85e079f2d...39.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40d63a0757e8dde632c5b9fba70a6267.bin

  • Size

    55KB

  • Sample

    240317-caa8pabh9x

  • MD5

    02a6c8d1804acff125d9970835482a1f

  • SHA1

    78235a68fcffc5f7fc0dc06d561216c93f3a34a4

  • SHA256

    1f2141e8d7c41cc057b8d82542a9c22634449d7a953d8c6016831458632591b7

  • SHA512

    cffd5f8fc653a1b32970dd4ea366bfe1da783c0396694869ffc13dd155b2095de84ee37c2809a8d387b3cd4771183f9feae187e93a52b26f1d3656529e59b0d9

  • SSDEEP

    768:dEixOlMuMb1UQ2OODYO8dptK4hYCW5C1QVebZTAOMZQjIu9Kks0FjRRGM095B5:dERlAb1UQ2hDy5KGZbHOu9KksGjeMC

Score
10/10
gafgyt

Malware Config

Extracted

Family

gafgyt

C2

78.40.117.218:23

Targets

    • Target

      d85e079f2d774cace1e6b544e57300efe3a51ee1fff2d499123ce39945c77939.elf

    • Size

      149KB

    • MD5

      40d63a0757e8dde632c5b9fba70a6267

    • SHA1

      874959e3178d3a92dfbbc9b9f8480939376e1605

    • SHA256

      d85e079f2d774cace1e6b544e57300efe3a51ee1fff2d499123ce39945c77939

    • SHA512

      ca22ddafe06163c13935dc72f4ac4d7b4e1600aa0f9a47b37d577b4cb869fd256eb0a9a55a52df0607e13077708d5f0dce6177b608291ec24b6be663a7599a03

    • SSDEEP

      3072:p+BnodZnZcBpaLrEJZTVKhv5hKEeu0sCXOmOMDQ4DzsL6Qse:pqbDJZhCv5hKEeOcOmOMDQ4DzsL6Qse

    Score
    6/10

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks