Overview

overview

10

Static

static

10

hidakibest.arm7.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hidakibest.arm7.elf

  • Size

    150KB

  • Sample

    241217-hjmkzatral

  • MD5

    ab95ee4bf912a26f4b3ade3838b06c50

  • SHA1

    3e4b7aa6550387a6ee87434ad6f28fb02369409b

  • SHA256

    fe8ec05418ee56297e3b9ed2c51f5ccd95daba01f935c2cbc69d9334633d92b0

  • SHA512

    b85a7b49f200524d7b79685cb5d1384b98da3315a99afb7850710928f513e9b109a5a61501b9bf5d4cbacde1af1d30cbb6209e399deef9e0a37eba2ab9d6a54c

  • SSDEEP

    3072:Tdbmn8aAEHqgSkano1DTAL5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTK5hWTGHIM/9ldmpwTsLS

Score
10/10
gafgytdiscovery

Malware Config

Extracted

Family

gafgyt

C2

49.0.254.78:4258

Targets

    • Target

      hidakibest.arm7.elf

    • Size

      150KB

    • MD5

      ab95ee4bf912a26f4b3ade3838b06c50

    • SHA1

      3e4b7aa6550387a6ee87434ad6f28fb02369409b

    • SHA256

      fe8ec05418ee56297e3b9ed2c51f5ccd95daba01f935c2cbc69d9334633d92b0

    • SHA512

      b85a7b49f200524d7b79685cb5d1384b98da3315a99afb7850710928f513e9b109a5a61501b9bf5d4cbacde1af1d30cbb6209e399deef9e0a37eba2ab9d6a54c

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAL5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTK5hWTGHIM/9ldmpwTsLS

    Score
    6/10
    discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks