General

  • Target

    chernobyl.mipsel.elf

  • Size

    149KB

  • Sample

    241231-jmhxmavmgv

  • MD5

    09fbd6192532776bf8dee1f50c3ff4ba

  • SHA1

    0993f366564ca42aebde6f745ce9c89b2589b142

  • SHA256

    419ec6de1da8f5e5e7b045bba9d3476e47ce5e754dee3e82bf0c77061038bacc

  • SHA512

    fb929af1bb9de820d0c05ca8ede19822f386fb03c47efb94897f97580b6930448817b96faed7a6bde2236e11bbdfc670b89994346f9a413cf94365d58bb8d606

  • SSDEEP

    3072:8nhw98IodlYfe+MTNC60nmY8sUFmujymeYBn3:8nhw98HMBG6X85FmujymtBn3

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

195.179.230.64:606

Targets

    • Target

      chernobyl.mipsel.elf

    • Size

      149KB

    • MD5

      09fbd6192532776bf8dee1f50c3ff4ba

    • SHA1

      0993f366564ca42aebde6f745ce9c89b2589b142

    • SHA256

      419ec6de1da8f5e5e7b045bba9d3476e47ce5e754dee3e82bf0c77061038bacc

    • SHA512

      fb929af1bb9de820d0c05ca8ede19822f386fb03c47efb94897f97580b6930448817b96faed7a6bde2236e11bbdfc670b89994346f9a413cf94365d58bb8d606

    • SSDEEP

      3072:8nhw98IodlYfe+MTNC60nmY8sUFmujymeYBn3:8nhw98HMBG6X85FmujymtBn3

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks