General

  • Target

    ftp.elf

  • Size

    122KB

  • Sample

    241111-r21d8atmem

  • MD5

    8bdb60f13472482a8a5450a81f8eb3b7

  • SHA1

    54bca8986f8624cf2dfdbb1161bfc9f4de5ca1b1

  • SHA256

    c55c6595480a937f378325b8111dac31876628c4d0ac8916dadec49c614b07b5

  • SHA512

    a0aa1a7db1f9c900fa165f8ae7121d98c1678f701874fefa546dba3c912b3ddab25c9d2053fd0ad7d4452cc579fdeacfec39616fdef974751316fb910163540c

  • SSDEEP

    3072:9Q+cZwVPs9u4vM9+NSEetJ8add9QzTs0zLt4NKcXeGcgqGK:9cqUtUSSEetJ8addQpLt4NKcXdcgqGK

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

93.123.85.201:23

Targets

    • Target

      ftp.elf

    • Size

      122KB

    • MD5

      8bdb60f13472482a8a5450a81f8eb3b7

    • SHA1

      54bca8986f8624cf2dfdbb1161bfc9f4de5ca1b1

    • SHA256

      c55c6595480a937f378325b8111dac31876628c4d0ac8916dadec49c614b07b5

    • SHA512

      a0aa1a7db1f9c900fa165f8ae7121d98c1678f701874fefa546dba3c912b3ddab25c9d2053fd0ad7d4452cc579fdeacfec39616fdef974751316fb910163540c

    • SSDEEP

      3072:9Q+cZwVPs9u4vM9+NSEetJ8add9QzTs0zLt4NKcXeGcgqGK:9cqUtUSSEetJ8addQpLt4NKcXdcgqGK

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks