Overview

overview

10

Static

static

10

504a1d38ce...1a.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52d0ae13c857d4eb4234dc595722dccc.bin

  • Size

    66KB

  • Sample

    241224-blj5asxpfk

  • MD5

    b8abb7cc62a6ba30b11d52290a1d2cd3

  • SHA1

    5a1195b8460dbc4d7e4b32ddb4506c73936a6e4c

  • SHA256

    d7733e302bb047eadeb32bb2585e48c283db70667a2cf6611705dc63dd667788

  • SHA512

    0de9cc9097c9482679d52cdc3e53ddb4397eabf53cbd7b094d0c577bbe13ebe8ea32eccfdfdf9aab910541db0b3543e61f0af16babc961aaea01c28c8474af74

  • SSDEEP

    1536:TeOyiLwaFZD+h35nW2KjRxPb6kPwLa80h/9w6Y9FYajM:+SwaupWpVxjLPwV0h/9w39F1M

Score
10/10
gafgytdiscovery

Malware Config

Extracted

Family

gafgyt

C2

185.216.71.152:4258

Targets

    • Target

      504a1d38ce1c64c802409879813a4707e35d5e0123e077e197ff6ab14627bc1a.elf

    • Size

      150KB

    • MD5

      52d0ae13c857d4eb4234dc595722dccc

    • SHA1

      8e38ea859ff096811f869980013931836a4b5be5

    • SHA256

      504a1d38ce1c64c802409879813a4707e35d5e0123e077e197ff6ab14627bc1a

    • SHA512

      dc8cbeb911cf55effdb0fd7fbc71fd388374bbc8b5e9ac7f8c616292934e61d8f696c48e76b514cb77ca34fed00c0b47a734fb1073c2579d09d96f88224a6665

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAD5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGHIM/9ldmpwTsLS

    Score
    6/10
    discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks