Overview

overview

10

Static

static

10

2d0189668b...47.elf

debian-12-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d1248c7440cc303428a2546d8b2f2fd.bin

  • Size

    69KB

  • Sample

    241206-bk822askfw

  • MD5

    82dec5ff1444ce2e009cbe8123e5cbd4

  • SHA1

    4fd487c78c5d6193276df24f518925081c4f051e

  • SHA256

    2fa3c4bfaf01ddbba415a69830f92ab45055f9e5e500fb87651eb0c738890a44

  • SHA512

    33eb6b0a8af49d1784c4b363ea9306b1ecb360a726d2c0d477d5c9e21d2f36fc80c1cb24b6f4e594b0f98851de5b8e36a394d600a4ca381cb3ce7d0109fa0e4b

  • SSDEEP

    1536:RommdOURmT/YI3g1XM5Va0cb5bL7Sgr+pD3c5e09e5h:FmA6mjYI3gdgaJ7XWITYh

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      2d0189668bb07a0712cbf7ddc77358ff4156a48025d447bd8c42c10c0853ea47.elf

    • Size

      174KB

    • MD5

      3d1248c7440cc303428a2546d8b2f2fd

    • SHA1

      c84ee7dc69bae0b67424c7abf45f76bc18558ae9

    • SHA256

      2d0189668bb07a0712cbf7ddc77358ff4156a48025d447bd8c42c10c0853ea47

    • SHA512

      89484e6cfe469bb3e63adfa2ae90f7f8dde3ef20b22289cc37459bbbf7cbf207ba69ff11707b0c582afdf4e792e3bf12da3fb6806b97d011c432325298e39799

    • SSDEEP

      3072:Pe1ywfQgR7Ee5ZiI/naVa1w/O/N2B1dLkHqsX43mGnWmgcygSw2EZAi:PMEyjaVa8OwdLkHqvmGnWmgcygSw2EZB

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (67819) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks