General

  • Target

    rebirth.arm4t.elf

  • Size

    146KB

  • Sample

    241230-bnzmrssrgq

  • MD5

    44ac5bfd6e8a96dd97b54293301c6d99

  • SHA1

    4227fe9d6d2ad8f699601d0bad9b2847f97b2cea

  • SHA256

    cb23913836827ebf6b4cec04f5a7247e03710c5bf275a73feb1ae49af04fa505

  • SHA512

    979f0cede396888493468d5d8958b1cb55b69bfe2a7fa9d3e44c14e03869ae6a143c1d7b5f0f708d3cc92cfd21989613a3ff48fe19bcc4ef8c340013ba9aaf48

  • SSDEEP

    3072:it8iFDKEfFN+Fa+1sW5h7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaN0h7rz0JH/Wb5mQwfCDi9

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

87.120.113.63:666

Targets

    • Target

      rebirth.arm4t.elf

    • Size

      146KB

    • MD5

      44ac5bfd6e8a96dd97b54293301c6d99

    • SHA1

      4227fe9d6d2ad8f699601d0bad9b2847f97b2cea

    • SHA256

      cb23913836827ebf6b4cec04f5a7247e03710c5bf275a73feb1ae49af04fa505

    • SHA512

      979f0cede396888493468d5d8958b1cb55b69bfe2a7fa9d3e44c14e03869ae6a143c1d7b5f0f708d3cc92cfd21989613a3ff48fe19bcc4ef8c340013ba9aaf48

    • SSDEEP

      3072:it8iFDKEfFN+Fa+1sW5h7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaN0h7rz0JH/Wb5mQwfCDi9

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks