Overview

overview

10

Static

static

10

8daebf6b1a...47.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a844f98dc6cd73706a8ee8378a2bd9ed.bin

  • Size

    66KB

  • Sample

    241224-b5248aylfl

  • MD5

    2a172268d5408d2980bc1ed697516636

  • SHA1

    348d3347dbd02754b5549ac5c9adc6edabc64383

  • SHA256

    f8e83c2d639986700252a4bc92418bb60b69a34ff05adb1caf12f49524e4ef6a

  • SHA512

    bb455a58f36dd9327c18b4cc84633511d3e3afb21bffa3bb7d6139c447d0e1ac9acb83a7dfb0a05c99636f07fd7f7a8204c252a4abaf4dfe8d41600e658e0c5d

  • SSDEEP

    1536:cJ8WGwenTSYTvDfBhcoFZ4oMNc2n2CPE0PF1zC/iAA:cJ8WOh3ncoF4Nc22CpPFM7A

Score
10/10
gafgytdiscovery

Malware Config

Extracted

Family

gafgyt

C2

31.172.83.147:4258

Targets

    • Target

      8daebf6b1ab5367a0e76c4f85f93b40b26fa26382b4231f187c3e2b241a7d347.elf

    • Size

      150KB

    • MD5

      a844f98dc6cd73706a8ee8378a2bd9ed

    • SHA1

      719c8825ab30ee3344263b85155f749574e9df8e

    • SHA256

      8daebf6b1ab5367a0e76c4f85f93b40b26fa26382b4231f187c3e2b241a7d347

    • SHA512

      0c02a541dd089d36ec783bfbdaf5c9ceed84d82a893953bbaa015c314c8569ebe54da0ffe428fd402822e69fd497c2a471bae94b3a99bb8ca4c2cfd763280784

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAp5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTk5hWTGHIM/9ldmpwTsLS

    Score
    6/10
    discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks