General

  • Target

    c3cf87c1ccc3b6c8fb6fb1487f1ab8ea.elf

  • Size

    135KB

  • Sample

    240727-blm6yszfkh

  • MD5

    c3cf87c1ccc3b6c8fb6fb1487f1ab8ea

  • SHA1

    2225668f88b7708e7ec34cf894b1cab0baad58d3

  • SHA256

    e5bdf6a3a8231817ab7b78932dcf2314cfff4bfcea3ff0df37f93fc7ee03be36

  • SHA512

    024d39d79b8628e5aa754bd4ba2678344fd0f825db099eed6b24e46202f48e0574e29b78285c80275cbea3b95db2d29f6a081cd001193bae34b8a9b535c1c909

  • SSDEEP

    3072:6P2pM0YkxftPZJp1Nl/zOj16wLVJP7FQjaOroWFaS/dUJZX7uTkYWk9my3QCYeAq:F6FQjaOroZJ9iTB9my3QCYeAgY8

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

94.154.172.62:23

Targets

    • Target

      c3cf87c1ccc3b6c8fb6fb1487f1ab8ea.elf

    • Size

      135KB

    • MD5

      c3cf87c1ccc3b6c8fb6fb1487f1ab8ea

    • SHA1

      2225668f88b7708e7ec34cf894b1cab0baad58d3

    • SHA256

      e5bdf6a3a8231817ab7b78932dcf2314cfff4bfcea3ff0df37f93fc7ee03be36

    • SHA512

      024d39d79b8628e5aa754bd4ba2678344fd0f825db099eed6b24e46202f48e0574e29b78285c80275cbea3b95db2d29f6a081cd001193bae34b8a9b535c1c909

    • SSDEEP

      3072:6P2pM0YkxftPZJp1Nl/zOj16wLVJP7FQjaOroWFaS/dUJZX7uTkYWk9my3QCYeAq:F6FQjaOroZJ9iTB9my3QCYeAgY8

    Score
    7/10
    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks