gafgyt | 3dd1122bb41177c32fb89f8616a0999707110316ba664e7ce19223436d7d22eb | Triage

Sharing

General

Target

3dd1122bb41177c32fb89f8616a0999707110316ba664e7ce19223436d7d22eb
Size

109KB
Sample

221125-lvrwlsha26
MD5

1473a537d4abaa5532c676d0dbfd3f63
SHA1

4429117617931d487bb93b5fec1e74da20434713
SHA256

3dd1122bb41177c32fb89f8616a0999707110316ba664e7ce19223436d7d22eb
SHA512

c3011bfd02d246fe3b092b151f19e5d5e0a3412884e7416b65d0150a5788e1bbbe5d98837c1070522b2359d3caab5f2d4c4019d2f6aa342612a79f567f05e7a4
SSDEEP

3072:BOaMSWo9KW8PuHUdY2M7ccyCGKVhmcQOYMGXzYd:BOaQo9p2MQcyChmcQOYM4zYd

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  3dd1122bb41177c32fb89f8616a0999707110316ba664e7ce19223436d7d22eb
- Size
  
  109KB
- MD5
  
  1473a537d4abaa5532c676d0dbfd3f63
- SHA1
  
  4429117617931d487bb93b5fec1e74da20434713
- SHA256
  
  3dd1122bb41177c32fb89f8616a0999707110316ba664e7ce19223436d7d22eb
- SHA512
  
  c3011bfd02d246fe3b092b151f19e5d5e0a3412884e7416b65d0150a5788e1bbbe5d98837c1070522b2359d3caab5f2d4c4019d2f6aa342612a79f567f05e7a4
- SSDEEP
  
  3072:BOaMSWo9KW8PuHUdY2M7ccyCGKVhmcQOYMGXzYd:BOaQo9p2MQcyChmcQOYM4zYd
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1