Overview

overview

10

Static

static

10

p-p.c-.Sakura.elf

debian-9-armhf

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    p-p.c-.Sakura.elf

  • Size

    105KB

  • Sample

    250114-ql86raypd1

  • MD5

    29c6784b75df2d651617f5063f4edab3

  • SHA1

    628aeff59bd45432c2bac040170fd8040a38e92b

  • SHA256

    18aa6d0cb419107cc58ccbdc2f56163879c84145077b71522606c49bbdfe1b95

  • SHA512

    95975aeb16ee32af9a0bfc6213409cca33158a1b39674b5951d38e11a5fe9683a05e5442b6601632ca2e8309bade2c737f7861d1ef49e365d5d9032e0e035d76

  • SSDEEP

    3072:MSY+46m1qOzssJFPPKNy+AmkZrQAhPDCXFke:06mgOzJJFPzmkZrQAhPDCXFke

Score
10/10
gafgytdiscovery

Malware Config

Extracted

Family

gafgyt

C2

23.95.72.10:12345

Targets

    • Target

      p-p.c-.Sakura.elf

    • Size

      105KB

    • MD5

      29c6784b75df2d651617f5063f4edab3

    • SHA1

      628aeff59bd45432c2bac040170fd8040a38e92b

    • SHA256

      18aa6d0cb419107cc58ccbdc2f56163879c84145077b71522606c49bbdfe1b95

    • SHA512

      95975aeb16ee32af9a0bfc6213409cca33158a1b39674b5951d38e11a5fe9683a05e5442b6601632ca2e8309bade2c737f7861d1ef49e365d5d9032e0e035d76

    • SSDEEP

      3072:MSY+46m1qOzssJFPPKNy+AmkZrQAhPDCXFke:06mgOzJJFPzmkZrQAhPDCXFke

    Score
    6/10
    discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks