gafgyt | assailant[.]arm6[.]elf

General

Target
assailant.arm6.elf
Size 139KB
Sample260620-p413ese12k
SHA256 5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863
MD5 0fc19cbfa36e288480f16a1abb577d06
SHA1 df7cf8b164f86f282c747bacec847df42937da3a
SHA512 9f54deeb702217c9552d1eb3546a2aa1a96667e99c3a44a70a8f6d46575aefd5e314aa95c008d508af6a0fca6bd948e604c82f6584bdbd317671ab389a7e3609
SSDEEP 3072:4pfNtKdcp3eQwP+HxP9xaefXW8QupNuXPFuw45hLlFOo6E6ErmyhQCYMhEFg:MHxP9xaefXW8Q3ur5hLlFOomyhQCYMhd
TLSH
T16BD33B05D8509727C6E227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet gafgyt

Family

C2

Family: Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

Detected Gafgyt variant 1 IoCs

resource	yara_rule
sample	family_gafgyt

SHA256 5739b534112d327669d19a06fa1ea6fba6bf5510f283dfd2ac561f4edf6b9863
MD5 0fc19cbfa36e288480f16a1abb577d06
SHA1 df7cf8b164f86f282c747bacec847df42937da3a
SHA512 9f54deeb702217c9552d1eb3546a2aa1a96667e99c3a44a70a8f6d46575aefd5e314aa95c008d508af6a0fca6bd948e604c82f6584bdbd317671ab389a7e3609
SSDEEP 3072:4pfNtKdcp3eQwP+HxP9xaefXW8QupNuXPFuw45hLlFOo6E6ErmyhQCYMhEFg:MHxP9xaefXW8Q3ur5hLlFOomyhQCYMhd
TLSH
T16BD33B05D8509727C6E227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021
MD5 SHA1 SHA512 SSDEEP TLSH

linux arm