Overview

overview

10

Static

static

10

d.elf

debian-9-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d.elf

  • Size

    121KB

  • Sample

    250105-jtwr3azmfr

  • MD5

    7d8109f34970487eec948588fa67e679

  • SHA1

    6dac660ba07326ce38f0d7d590b095aa63af028f

  • SHA256

    9221c5b3323f5cff014fd9c2fb858e63945912c6248caca5f81e43b056bd0359

  • SHA512

    db9bc9819318be915668fceb4db750acd7f51d6c3753da105e07a52d6d8d978c35cf49580cb34bc0ad98578f7e260695a8703c10531f06435da2c8f33a7e965b

  • SSDEEP

    3072:W/cpZ7oB+UAx1DdpUhbsJWCd2BmPI6aQasyKf1vRe:i6UA1pUhbwWGkmPI6aQasyKf1vRe

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      d.elf

    • Size

      121KB

    • MD5

      7d8109f34970487eec948588fa67e679

    • SHA1

      6dac660ba07326ce38f0d7d590b095aa63af028f

    • SHA256

      9221c5b3323f5cff014fd9c2fb858e63945912c6248caca5f81e43b056bd0359

    • SHA512

      db9bc9819318be915668fceb4db750acd7f51d6c3753da105e07a52d6d8d978c35cf49580cb34bc0ad98578f7e260695a8703c10531f06435da2c8f33a7e965b

    • SSDEEP

      3072:W/cpZ7oB+UAx1DdpUhbsJWCd2BmPI6aQasyKf1vRe:i6UA1pUhbwWGkmPI6aQasyKf1vRe

    Score
    7/10
    defense_evasiondiscovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks