Overview

overview

10

Static

static

10

1e7f0ad6f4...a9.elf

debian-9-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57e10fd1d7754fe9f5c25709c4b15014.bin

  • Size

    63KB

  • Sample

    241206-bqb99aykhq

  • MD5

    b6e24d0893ea5eeae529010b95f7c62b

  • SHA1

    0d25b82dcbe245efe0c8a6b2f7958196626dae61

  • SHA256

    30fca47b7a0f52e1b616dcd6d4b982843496d44a5a58e7b8d2b2756e904ad215

  • SHA512

    903b7f932a9e097d79d365f04ae3e4757fc79d7352aa411412b106c00de7c665358290486ab974d574a58c9f580893ecf382d5807d5ceca99177a31bf02914ba

  • SSDEEP

    1536:QyFrzEsBCAn91MGyQkmatkt5yHWA7HDwwIFLG5rOwtDa5g:Qy6sAQMGyvGt5yP7HDbNxJ

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      1e7f0ad6f4c47c09786c5ef1df5dc9e23af63899437bf42e5dd09789378ff6a9.elf

    • Size

      161KB

    • MD5

      57e10fd1d7754fe9f5c25709c4b15014

    • SHA1

      92f5a85561ed547d055cf484165e7d310533c124

    • SHA256

      1e7f0ad6f4c47c09786c5ef1df5dc9e23af63899437bf42e5dd09789378ff6a9

    • SHA512

      a420bc0e629052978a122253cdeed0c7b8a961feabc005c57f43824587445ea14905d4b1e19d3e0fac94e9bf2ff8faaf33298e057800258c88d82e154d635ea8

    • SSDEEP

      3072:fywgcFqA5RXHX72MORPiXVN6eXLBYwArfyDujp+SmjlliUmh:lvFKMOZUN6eXLyPKDujp+SmjlliUmh

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (67323) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks