General

  • Target

    bash.elf

  • Size

    140KB

  • Sample

    241111-r21d8azgrp

  • MD5

    f33885bc2951d654477cb4f4d5f1c36f

  • SHA1

    6ee7b0cd26df6ed278a52d73ae584232d230f72a

  • SHA256

    93c83f99138f321d5fd8ab5f5818cadaa0b344aa444b0dddc8431898c0e48b15

  • SHA512

    257fc1b0e2765b0962b325cd7ef7600066b10df0ab18017bb7c7f991503fcae6a72582d7dabab9ccc0c2c814e0efdbb62070283f0cc20ff884db469ca1c20a41

  • SSDEEP

    3072:2p1gtKJfVEGvGPAXXRRV0sfiutJ8adPF4KQTjscJQiu/TagOAMebvfcivGmS+Qk:2PE6zXBReButJ8adPF4fXJqeAMebvfcK

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

93.123.85.201:23

Targets

    • Target

      bash.elf

    • Size

      140KB

    • MD5

      f33885bc2951d654477cb4f4d5f1c36f

    • SHA1

      6ee7b0cd26df6ed278a52d73ae584232d230f72a

    • SHA256

      93c83f99138f321d5fd8ab5f5818cadaa0b344aa444b0dddc8431898c0e48b15

    • SHA512

      257fc1b0e2765b0962b325cd7ef7600066b10df0ab18017bb7c7f991503fcae6a72582d7dabab9ccc0c2c814e0efdbb62070283f0cc20ff884db469ca1c20a41

    • SSDEEP

      3072:2p1gtKJfVEGvGPAXXRRV0sfiutJ8adPF4KQTjscJQiu/TagOAMebvfcivGmS+Qk:2PE6zXBReButJ8adPF4fXJqeAMebvfcK

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks