gafgyt | 4880f8dd2d88e4426caf5007afe822e430a80bc84ffefa839d35e313a33aa0a7 | Triage

Sharing

General

Target

4880f8dd2d88e4426caf5007afe822e430a80bc84ffefa839d35e313a33aa0a7
Size

110KB
Sample

221130-pt66padh31
MD5

fbc913ab0d4ccba6029fdfe166276f8e
SHA1

93e15ff30f055b0aa5e0e8f3fb2aa27327e82724
SHA256

4880f8dd2d88e4426caf5007afe822e430a80bc84ffefa839d35e313a33aa0a7
SHA512

5203a502da0146a807e501c69d0094d366c27571b5c2c9bd22e672a25298f6eeb906d6f3b70dfb303bcf1e39621380234e33a4f849b1c292bd28ed81bb84ad59
SSDEEP

1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2OOxt2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUre1tTDCLUmkiSFxfKxbXe

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  4880f8dd2d88e4426caf5007afe822e430a80bc84ffefa839d35e313a33aa0a7
- Size
  
  110KB
- MD5
  
  fbc913ab0d4ccba6029fdfe166276f8e
- SHA1
  
  93e15ff30f055b0aa5e0e8f3fb2aa27327e82724
- SHA256
  
  4880f8dd2d88e4426caf5007afe822e430a80bc84ffefa839d35e313a33aa0a7
- SHA512
  
  5203a502da0146a807e501c69d0094d366c27571b5c2c9bd22e672a25298f6eeb906d6f3b70dfb303bcf1e39621380234e33a4f849b1c292bd28ed81bb84ad59
- SSDEEP
  
  1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2OOxt2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUre1tTDCLUmkiSFxfKxbXe
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1