Summary information for the three binaries we analyzed follows:    MD5 364ff454dcf00420cff13a57bcb78467   SHA-256 8bca0031f3b691421cb15f9c6e71ce19335 5d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l0H786 O26BmMAwyWMn/qwwiHNl:n+1R43QcIL XdF0w6IBmMAwwCwwi   Size 141.2 KB (144560 bytes)   Type ELF 64-bit (stripped)   Install as root /bin/rsyncd   Root install desc synchronize and backup service   Install as non-root ~/.config/dbus-notifier/dbus-inotifier   Non-root install desc system service d-bus notifier   C2 azureon-line[.]com (TCP/80)   Usage Timeframe Late 2014    Table 1: Sample 1 – Late 2014 Sofacy 64-bit Fysbis    MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2 480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454U NqRpROIDLHaSeWb3LGmPTrIW33HxIajF: 9ZAxHANJAvbuZf454UN+rv eQLZPTrV3Z   Size 175.9 KB (180148 bytes)   Type ELF 32-bit (stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 198.105.125[.]74 (TCP/80)   Usage Timeframe Early 2015    Table 2: Sample 2 – Early 2015 Sofacy 32-bit Fysbis    MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed 9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUd c4mLc2B9:4D5Lqgkcj+   Size 314.4 KB (321902 bytes)   Type ELF 64-bit (not stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 mozilla-plugins[.]com (TCP/80)   Usage Timeframe Late 2015    Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis Overall, these binaries are assessed as low sophistication, but effective