gafgyt | eae62f409bfdeb4cd44998348efc4a523765cb85614a9c6dab99dcbe3293f0a0

General

Target
45.61.164.81_sample.bin
Size 127KB
Sample261014-19raystsgs
SHA256 eae62f409bfdeb4cd44998348efc4a523765cb85614a9c6dab99dcbe3293f0a0
MD5 4039e8ff4d0909c223bf859be4b98358
SHA1 df87ecb0169eff5f0ace9d7755a49fe057d74809
SHA512 219a4f4e60102caa132561cdf2d8076c40010d23ad9a39219bf3d5bcf652b227431887df52d033245e6d1f8343d9177c3538e9ba22b3df9a4f2462e895153eb4
SSDEEP 3072:M7wO4jq6UjInrbwk06t84punav8D/qsceEORv+X3/X7LntVbnq:M7wBl0grbXPPcnaviNceEev+X3/X7Lnq
TLSH
T1FBD34BC3AB81D5B3C19319B212ABC75041B2E4771A1BCA99F3AD3CB4AB14684F715B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  45.61.164.81_sample.bin
- Size 127KB
- SHA256 eae62f409bfdeb4cd44998348efc4a523765cb85614a9c6dab99dcbe3293f0a0
- MD5 4039e8ff4d0909c223bf859be4b98358
- SHA1 df87ecb0169eff5f0ace9d7755a49fe057d74809
- SHA512 219a4f4e60102caa132561cdf2d8076c40010d23ad9a39219bf3d5bcf652b227431887df52d033245e6d1f8343d9177c3538e9ba22b3df9a4f2462e895153eb4
- SSDEEP 3072:M7wO4jq6UjInrbwk06t84punav8D/qsceEORv+X3/X7LntVbnq:M7wBl0grbXPPcnaviNceEev+X3/X7Lnq
- TLSH
  T1FBD34BC3AB81D5B3C19319B212ABC75041B2E4771A1BCA99F3AD3CB4AB14684F715B7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

command_and_control credential_access defense_evasion discovery execution
- Contacts a large (142307) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1