Overview
overview
10Static
static
10
debian-9-armhf
1apache2
debian-12-armhf
1bash
ubuntu-22.04-amd64
1cron
ubuntu-18.04-amd64
cron
debian-9-armhf
cron
debian-9-mips
cron
debian-9-mipsel
ftp
ubuntu-22.04-amd64
1ftp1.sh
windows7-x64
3ftp1.sh
windows10-2004-x64
3ntpd
debian-9-mips
openssh
ubuntu-18.04-amd64
openssh
debian-9-armhf
openssh
debian-9-mips
openssh
debian-9-mipsel
pftp
ubuntu-18.04-amd64
pftp
debian-9-armhf
pftp
debian-9-mips
pftp
debian-9-mipsel
sh
ubuntu-18.04-amd64
sh
debian-9-armhf
sh
debian-9-mips
sh
debian-9-mipsel
sshd
debian-12-mipsel
tftp
debian-12-armhf
1wget
ubuntu-24.04-amd64
1Behavioral task
behavioral1
Sample
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral2
Sample
apache2
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral3
Sample
bash
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral4
Sample
cron
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral5
Sample
cron
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral6
Sample
cron
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral7
Sample
cron
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral8
Sample
ftp
Resource
ubuntu2204-amd64-20240522-en
Behavioral task
behavioral9
Sample
ftp1.sh
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ftp1.sh
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
ntpd
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
openssh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral13
Sample
openssh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral14
Sample
openssh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral15
Sample
openssh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral16
Sample
pftp
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral17
Sample
pftp
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral18
Sample
pftp
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral19
Sample
pftp
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral20
Sample
sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral21
Sample
sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral22
Sample
sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral23
Sample
sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral24
Sample
sshd
Resource
debian12-mipsel-20240418-en
Behavioral task
behavioral25
Sample
tftp
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral26
Sample
wget
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
765f5277d33398d9655b8cd02708fa29_JaffaCakes118
-
Size
527KB
-
MD5
765f5277d33398d9655b8cd02708fa29
-
SHA1
6d1e44c9bd06b72bcab1a2f2cd4620a3c5227683
-
SHA256
ebb82fd7e2c357521871f22cfe67907829dc7feacec4ccef53b46629791640b2
-
SHA512
41fa6f05f2c512005dd2dc1905a4e194a91e61a3456d623dabfd6c809ce5d870ec9730d4a4620873386603b8a1fa7fdaec3474369b278127a46436ad3db8fb71
-
SSDEEP
12288:OuOQMitNLZItlGziQPJ0hQAr6teVwjnmhmk:OuzLqnGb0hUeV6mhmk
Malware Config
Extracted
gafgyt
91.209.70.108:1337
Signatures
-
Detected Gafgyt variant 12 IoCs
resource yara_rule static1/unpack001/ family_gafgyt static1/unpack001/apache2 family_gafgyt static1/unpack001/bash family_gafgyt static1/unpack001/cron family_gafgyt static1/unpack001/ftp family_gafgyt static1/unpack001/ntpd family_gafgyt static1/unpack001/openssh family_gafgyt static1/unpack001/pftp family_gafgyt static1/unpack001/sh family_gafgyt static1/unpack001/sshd family_gafgyt static1/unpack001/tftp family_gafgyt static1/unpack001/wget family_gafgyt -
Gafgyt family
Files
-
765f5277d33398d9655b8cd02708fa29_JaffaCakes118.zip
-
.elf linux arm
-
apache2.elf linux arm
-
bash.elf linux x64
-
cron.elf linux ppc
-
ftp.elf linux x86
-
ftp1.sh
-
ntpd.elf linux mipsbe
-
openssh.elf linux sh
-
pftp.elf linux
-
sh.elf linux sparc
-
sshd.elf linux mipsel
-
tftp.elf linux arm
-
wget.elf linux x86