Overview

overview

10

Static

static

10

b101a75e8d...a7.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a4904e2a861a3b1181d48a97a20e0a1.bin

  • Size

    66KB

  • Sample

    241224-bk5plsxmez

  • MD5

    7f9b9337cd519c54398d6e853d0f4e72

  • SHA1

    f0afbe35690f59c5fd4f2866f24ce9e819a8d412

  • SHA256

    e332a7dd7ed82ee738c961e6435205d576f68596621c282814bf77b0ccaa39fb

  • SHA512

    024694f93d19f0bdccf11be6257154a3235e05b66eb1d063eb1afd41042649988cb2d4dd19bb77a7f53cef618f955b9fe03f4e6257ec24419b1d0faba09ec171

  • SSDEEP

    1536:vvOdy5v6XB4pg5kuHfa9UA8NMM0bspEgQzAf8PnDKkuyB:vvAcOWeVHfSUA8KvbeKnvGkuyB

Score
10/10
gafgytdiscovery

Malware Config

Extracted

Family

gafgyt

C2

185.216.71.152:4258

Targets

    • Target

      b101a75e8db5b23a67d9942e90c2bba636dc331abf8a3eec9f77eaaf2b41eda7.elf

    • Size

      150KB

    • MD5

      4a4904e2a861a3b1181d48a97a20e0a1

    • SHA1

      49c3fcfaf0d8ee5e429b1d2a3717ef8d20a33651

    • SHA256

      b101a75e8db5b23a67d9942e90c2bba636dc331abf8a3eec9f77eaaf2b41eda7

    • SHA512

      b0f2a26e5dad50b3d31b86fa8dedb13eeeb89d7c652f25dce5e51aae4ca51bf71f02d7d9a402f4060c919dff195dca6bf4b0f1ca29e49d2bddaaa4957f96d623

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAD5hWTGU2WV7lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGU2WV7ldmpwTsLS

    Score
    6/10
    discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks