General

  • Target

    rebirth.arm6.elf

  • Size

    146KB

  • Sample

    241230-bnz9astjam

  • MD5

    1d8f0e4a796c584f0f0f14ac038008d9

  • SHA1

    f25c9eb44e8949c5ee2f096a3f4706b4c8c21682

  • SHA256

    41be292c34198d77d921b430e51cc18621a975e7b4c12c8516bcca4678a9d66a

  • SHA512

    1a3e3716051c551adc7ee15e4f5277727f78f8fb9a0243150538da570b330b924485e68119bad5b0389cef9b9f9d25f5e45950bff18cb5059afdf7ec3f950d6e

  • SSDEEP

    3072:ut8iFDKEfFN+Fa+1sW5h7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaN0h7nI8txVp5mQwfCDiGW

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

87.120.113.63:666

Targets

    • Target

      rebirth.arm6.elf

    • Size

      146KB

    • MD5

      1d8f0e4a796c584f0f0f14ac038008d9

    • SHA1

      f25c9eb44e8949c5ee2f096a3f4706b4c8c21682

    • SHA256

      41be292c34198d77d921b430e51cc18621a975e7b4c12c8516bcca4678a9d66a

    • SHA512

      1a3e3716051c551adc7ee15e4f5277727f78f8fb9a0243150538da570b330b924485e68119bad5b0389cef9b9f9d25f5e45950bff18cb5059afdf7ec3f950d6e

    • SSDEEP

      3072:ut8iFDKEfFN+Fa+1sW5h7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaN0h7nI8txVp5mQwfCDiGW

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks