General

  • Target

    rebirth.arm6.elf

  • Size

    146KB

  • Sample

    241230-bpk6rstjcm

  • MD5

    c75514007eb45572d82ff8cc671f1413

  • SHA1

    8be305a7a75aa65b17664661ddba5f4d91515448

  • SHA256

    cf1b41704e0b8fc788d6df9eb66d496855af820a2ecedabdaff7dcef7e57f33b

  • SHA512

    d47278afdf2e405fc655d1bc551bbe72aa7f0a396278caa026fffb1196dfebc5316c0944656f8c8b60f19ec93792232227a455921d0d9dd81f1291c5db3f1964

  • SSDEEP

    3072:ut8iFDKEfFN+Fa+1sWth7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNoh7nI8txVp5mQwfCDiGW

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

23.95.72.235:666

Targets

    • Target

      rebirth.arm6.elf

    • Size

      146KB

    • MD5

      c75514007eb45572d82ff8cc671f1413

    • SHA1

      8be305a7a75aa65b17664661ddba5f4d91515448

    • SHA256

      cf1b41704e0b8fc788d6df9eb66d496855af820a2ecedabdaff7dcef7e57f33b

    • SHA512

      d47278afdf2e405fc655d1bc551bbe72aa7f0a396278caa026fffb1196dfebc5316c0944656f8c8b60f19ec93792232227a455921d0d9dd81f1291c5db3f1964

    • SSDEEP

      3072:ut8iFDKEfFN+Fa+1sWth7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNoh7nI8txVp5mQwfCDiGW

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks