General

  • Target

    chernobyl.x86.elf

  • Size

    108KB

  • Sample

    241231-jmh8dsvmgx

  • MD5

    428ae9d3ab9e21f223c97f307368b515

  • SHA1

    14b9c1e77f6c383fb62461a69b134a56d2c55852

  • SHA256

    a9bdde3e36898a8c07d2dae612780db4c20cda764452c195e749693b7edd9b6c

  • SHA512

    0707f38c0b276a72cd2f16f250c305757c139db16cfab0b6b8903b98403ae8812df2a9c4c5db73a9368a10f19a9453387cde5532324aeba1b50cd9fe944c3e89

  • SSDEEP

    3072:zppifQ9GMzKlIDZ1la/vEFgmI13gBHhuf:zDzemI13ghhuf

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

195.179.230.64:606

Targets

    • Target

      chernobyl.x86.elf

    • Size

      108KB

    • MD5

      428ae9d3ab9e21f223c97f307368b515

    • SHA1

      14b9c1e77f6c383fb62461a69b134a56d2c55852

    • SHA256

      a9bdde3e36898a8c07d2dae612780db4c20cda764452c195e749693b7edd9b6c

    • SHA512

      0707f38c0b276a72cd2f16f250c305757c139db16cfab0b6b8903b98403ae8812df2a9c4c5db73a9368a10f19a9453387cde5532324aeba1b50cd9fe944c3e89

    • SSDEEP

      3072:zppifQ9GMzKlIDZ1la/vEFgmI13gBHhuf:zDzemI13ghhuf

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks