General

  • Target

    keksec.x86.elf

  • Size

    140KB

  • Sample

    241226-kpvvms1phq

  • MD5

    0f1676b1363d0e5268e4e8e6dc572b62

  • SHA1

    8061f19240f26a5adf65727e41ed032650c89d0e

  • SHA256

    8635f296dd8324b34b563be5f1116cd161b1d3476d65dc5aa324f1b6d4b0fdf4

  • SHA512

    6fa8d714a6eca7f2beace38d709b0ef3cd0d35a7bf0cf952fe4faff298b708ecba056482a79ceec217e6e44473ba197d0a491e76c9806804c1f093ae465253a0

  • SSDEEP

    3072:c6UyaR370QkWuZI3zKZPhJephaO+1QktUm+QVOXFNqOPPe:OXOI3mYphaN1Qxm+QVOXFNqOPPe

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

179.43.172.120:23

Targets

    • Target

      keksec.x86.elf

    • Size

      140KB

    • MD5

      0f1676b1363d0e5268e4e8e6dc572b62

    • SHA1

      8061f19240f26a5adf65727e41ed032650c89d0e

    • SHA256

      8635f296dd8324b34b563be5f1116cd161b1d3476d65dc5aa324f1b6d4b0fdf4

    • SHA512

      6fa8d714a6eca7f2beace38d709b0ef3cd0d35a7bf0cf952fe4faff298b708ecba056482a79ceec217e6e44473ba197d0a491e76c9806804c1f093ae465253a0

    • SSDEEP

      3072:c6UyaR370QkWuZI3zKZPhJephaO+1QktUm+QVOXFNqOPPe:OXOI3mYphaN1Qxm+QVOXFNqOPPe

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks