General

  • Target

    rebirth.arm4t.elf

  • Size

    146KB

  • Sample

    241230-bn1j3atjan

  • MD5

    b2aabefbc7860352076b60aaa6bf4306

  • SHA1

    3300e89b84691d6665e800a7e509bc3774b8fff0

  • SHA256

    84650441da7a8f1258d1decaebc9b38d6855679280ff7afc3255bf85f3678cca

  • SHA512

    df13eec6eb24562de2d9552e7582ca4b582888d3c86e1fea5e2d35902eb4c5bfac5826c467b0a2851f78c0178e317100c435c2b142cb7343ac90a2c051576b4a

  • SSDEEP

    3072:it8iFDKEfFN+Fa+1sWth7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNoh7rz0JH/Wb5mQwfCDi9

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

23.95.72.235:666

Targets

    • Target

      rebirth.arm4t.elf

    • Size

      146KB

    • MD5

      b2aabefbc7860352076b60aaa6bf4306

    • SHA1

      3300e89b84691d6665e800a7e509bc3774b8fff0

    • SHA256

      84650441da7a8f1258d1decaebc9b38d6855679280ff7afc3255bf85f3678cca

    • SHA512

      df13eec6eb24562de2d9552e7582ca4b582888d3c86e1fea5e2d35902eb4c5bfac5826c467b0a2851f78c0178e317100c435c2b142cb7343ac90a2c051576b4a

    • SSDEEP

      3072:it8iFDKEfFN+Fa+1sWth7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNoh7rz0JH/Wb5mQwfCDi9

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks