General

  • Target

    m-p.s-l.Sakura.elf

  • Size

    123KB

  • Sample

    241109-j1kcls1crb

  • MD5

    2f8d1fa81c96b9ced0716fb5e6e8a85c

  • SHA1

    f38f9036c77246d1ff7bfc670a14dad80aec636a

  • SHA256

    25565cf294db52a71ed0d31972780b1605083d7885ac50001bd0bd91aa8a836f

  • SHA512

    8509d399f5cd997ab27e8df0afea48ed4dbb5ede0ef4e1568be1fc7aa414ab98114a48824bfbe72a841af6d042995cad4d8192ac518861d36d14ca1038ee6b03

  • SSDEEP

    1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epb+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8ER+Dw8rmW+IFB1Dt1hR/

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

93.123.85.232:12345

Targets

    • Target

      m-p.s-l.Sakura.elf

    • Size

      123KB

    • MD5

      2f8d1fa81c96b9ced0716fb5e6e8a85c

    • SHA1

      f38f9036c77246d1ff7bfc670a14dad80aec636a

    • SHA256

      25565cf294db52a71ed0d31972780b1605083d7885ac50001bd0bd91aa8a836f

    • SHA512

      8509d399f5cd997ab27e8df0afea48ed4dbb5ede0ef4e1568be1fc7aa414ab98114a48824bfbe72a841af6d042995cad4d8192ac518861d36d14ca1038ee6b03

    • SSDEEP

      1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epb+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8ER+Dw8rmW+IFB1Dt1hR/

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks