UnknownPublished 7 Nov 2024Updated 2 Jun 2025

OSINT · Gorilla DDoS

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Gorilla DDoS

Impact

For European organizations, the primary impact of a denial of service threat like Gorilla DDoS would be disruption of network or endpoint availability. This could lead to temporary service outages, degraded performance, and potential operational interruptions. Critical infrastructure, financial institutions, healthcare providers, and public sector entities could be affected if targeted, resulting in service unavailability that impacts end users and business continuity. However, given the low severity and lack of known active exploitation, the immediate risk is limited. The threat could serve as an early warning to monitor for emerging DDoS campaigns or related network disruptions. If the threat evolves or is weaponized, it could increase in severity and impact, particularly for organizations with internet-facing services or insufficient DDoS mitigation capabilities. European organizations should consider the potential for increased network traffic anomalies and prepare incident response plans accordingly.

Defensive guidance

1. Implement and regularly update network-level DDoS protection solutions such as traffic filtering, rate limiting, and anomaly detection to identify and mitigate unusual traffic patterns indicative of DDoS attacks. 2. Deploy endpoint protection and monitoring tools capable of detecting abnormal resource consumption or denial of service conditions at the host level. 3. Establish robust incident response procedures specifically for denial of service scenarios, including communication plans and escalation paths. 4. Collaborate with Internet Service Providers (ISPs) and utilize upstream filtering or scrubbing services to absorb or block malicious traffic before it reaches critical infrastructure. 5. Conduct regular network and endpoint resilience testing to ensure systems can handle traffic spikes and recover quickly from disruptions. 6. Monitor OSINT feeds and threat intelligence sources for updates on Gorilla DDoS or related campaigns to adapt defenses proactively. 7. Harden network infrastructure by disabling unnecessary services and closing unused ports to reduce attack surface. 8. Consider implementing redundancy and failover mechanisms to maintain service availability during attack conditions.

Indicators of compromise

Domains 330

gorillacnc.su
gorillabin.su
gorillaservices.su
gorillafirewall.su
gorillaproxy.su
gorilla-api.su
154.216.17.182
154.216.17.182
154.216.17.182
154.216.17.182

URLs 162

http://154.216.17.182/arm6.nn
http://154.216.17.182/arm7.nn
http://154.216.17.182/lol
http://154.216.17.182/lol.sh
http://154.216.17.182/x86_64.nn
http://154.216.18.173/arm6.nn
http://154.216.18.173/lol
http://154.216.18.173/lol.sh
http://154.216.18.173/x86_64.nn
http://154.216.19.61/arm5.nn

IP addresses 15

193.143.1.61On port 80
193.143.1.70On port 80
193.143.1.66On port 7070
193.143.1.56On port 7070
193.143.1.62On port 7070
185.170.144.85On port 7070
154.216.19.146On port 7070
94.156.177.62On port 7070
93.123.85.166On port 38241
45.202.35.64On port 38241

Hashes 84

3c21544cfb3979b9d823eac46998f86a
5a529aea9f676840b070bddc1b92519f57203b71
a9a56ecee25fb22a19757e98133aeb858312377f6fd9c2bbb747edf687ed8547
c58072fb79dbc1c71f16aed468a3e97f96aa17f2e1d9e3b6065defdc0d9cae73aaa1ca1389299e63de92f00ffe95e04ba766ab765fbee37167dbe156c9e0899e
dac26d3f514daf8f091b4599cd062a71
46720cd8faf68bf8ba8ef1fa46b39d012271153a
fca79d9e3088517e1b7a8228af27527ee8e0b7060a2f8164b7b750f917d313b1
130a9d9811f1504565a918d662e3cb042a28be8d9542e413af07f8e71c603cd7301cb8c403055a17c8351b0b71b6e577209c0141528fd8c8ec473100610a48e0
7cd2de3905e9ec35d981d1e2e8208137
8860ecc3dd756954216d9d441a2ff9512bb6bec5

Text 432

/arm6.nn
154.216.17.182
/arm7.nn
154.216.17.182
/lol
154.216.17.182
/lol.sh
154.216.17.182
/x86_64.nn
154.216.17.182

Link 1

https://github.com/govcert-ch/CTI/blob/main/20241010_GorillaBot/20241010_NCSC-CH-GorillaBot.pdf

File 5

20241010_NCSC-CH-GorillaBot.pdf
a9a56ecee25fb22a19757e98133aeb858312377f6fd9c2bbb747edf687ed8547
14fb8b3b89c5f626519950882f242dd53889b1067578a9321e721dbf4311a91f
d50acb9b20222c4e4a616a2ccc095eec2780141da7d4264a5ba2f82cae9c4670
a9a56ecee25fb22a19757e98133aeb858312377f6fd9c2bbb747edf687ed8547

Size in bytes 21

616
19
80550
14
15312
16
16
2208
10696
62

Float 19

4.7352556208588
3.4058222502857
6.2614147616808
3.3787834934862
5.4563632549439
1
1
3.9962404616202
3.5847266094526
6.3228588477239

Malware sample 3

a9a56ecee25fb22a19757e98133aeb858312377f6fd9c2bbb747edf687ed8547|3c21544cfb3979b9d823eac46998f86a
14fb8b3b89c5f626519950882f242dd53889b1067578a9321e721dbf4311a91f|6cfca1b6f1302235cf09a9942ba1d3c6
d50acb9b20222c4e4a616a2ccc095eec2780141da7d4264a5ba2f82cae9c4670|4dc38c34e95ee063a4328a07871689ff

Mime type 3

text/plain
application/x-executable
application/x-executable

Ssdeep 21

12:PRGH9vPnccGsQP1qyAA5Sq7FeIKW1h+A1DFTFIbn:PsXnWsYdAA5bMIKW1hV1Zun
3:4o/ns4U:fU4U
1536:5JOA3BJHQbOqxM21+4M280LWcmTmNGeccRJ6p2laHu12F+pHxvBVuK:SARJHp8M2Q4B80icmTKVJ02lD12F+Tvj
3:4mFtWU:RGU
384:WsDvgVuIGwhxHePdOnxxxxxxxxxxxxxxxOxuxxxxxxxZxxxsxxUexAjjjjjjjjjc:WszgApwhxHI0nxxxxxxxxxxxxxxxOxu+
3:RRR//:LRX
3:RRR//:LRX
24:H4OJYpAKbqmMepg/pPsnRkysDbuC1+Xja1gs+y1OXGK1Q/BEWIbvxHwfULmqAyDo:H8P8RZgWqAw5eCefcmqxDgDh21664
3::
3:dqMLwlApLQ4lLaCMLdsxlLB4K2in:kMF84MFsOin

Counter 2

Community reviews

Loading reviews…