Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

5f2c807c01...18.elf

debian-9-mips

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f2c807c01f4e1fdfa7acddf2e1a8d18.elf

  • Size

    167KB

  • Sample

    240326-s7lzfsge3w

  • MD5

    5f2c807c01f4e1fdfa7acddf2e1a8d18

  • SHA1

    4d04321b1f95199320dc0bc500bd9b0fc56794b3

  • SHA256

    56cff0b88f2b3ec69c36186efafc52bf2ee96afcee72377caa936507f393a9f5

  • SHA512

    d94adc02a7ff5f71c4a58701e2087636b37ec4415da422f905cae6c3de44d0fa9a5f0e0231e03d6579ff258b86f1c57709a3d00a662973b5c6167fe5c5714eb3

  • SSDEEP

    3072:pco9lOZjiHH3LmeeB6QetJ8au49QuhsEVBvNNharTg6KrmNv1jD:FnOZji3K/EQetJ8au4l9VBFNharTg6KE

Score
10/10
gafgyt

Malware Config

Extracted

Family

gafgyt

C2

91.92.254.140:562

Targets

    • Target

      5f2c807c01f4e1fdfa7acddf2e1a8d18.elf

    • Size

      167KB

    • MD5

      5f2c807c01f4e1fdfa7acddf2e1a8d18

    • SHA1

      4d04321b1f95199320dc0bc500bd9b0fc56794b3

    • SHA256

      56cff0b88f2b3ec69c36186efafc52bf2ee96afcee72377caa936507f393a9f5

    • SHA512

      d94adc02a7ff5f71c4a58701e2087636b37ec4415da422f905cae6c3de44d0fa9a5f0e0231e03d6579ff258b86f1c57709a3d00a662973b5c6167fe5c5714eb3

    • SSDEEP

      3072:pco9lOZjiHH3LmeeB6QetJ8au49QuhsEVBvNNharTg6KrmNv1jD:FnOZji3K/EQetJ8au4l9VBFNharTg6KE

    Score
    7/10

    • Changes its process name

    • Deletes itself

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks