gafgyt | edb1f8469d9596c3fd6ff7ac20ecc0e2d1d4831bfd20288a7be0a1ffe63bada3 | Triage

Sharing

General

Target

5139114248cea9b2e0bc79fbb2dcbd24.elf
Size

110KB
Sample

230318-wvw6fadc37
MD5

5139114248cea9b2e0bc79fbb2dcbd24
SHA1

375b2ace82a7f6e8d45df1287378ff2db6b9acba
SHA256

edb1f8469d9596c3fd6ff7ac20ecc0e2d1d4831bfd20288a7be0a1ffe63bada3
SHA512

4ea1087d2fcfb9130ab6370dc3dc039b9b7b8080e723f63ced71501fce3ef4f472ac3fa3d041d6bc053daf86c07f0a6ac2b9bddc6fa002fd1e2e8b7868b1fec5
SSDEEP

3072:R/4tNF9U4vvlKw6J73x8UmkiSFxfKxbXe:BUNFK+l8T8UmkiSFxfKxbXe

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  5139114248cea9b2e0bc79fbb2dcbd24.elf
- Size
  
  110KB
- MD5
  
  5139114248cea9b2e0bc79fbb2dcbd24
- SHA1
  
  375b2ace82a7f6e8d45df1287378ff2db6b9acba
- SHA256
  
  edb1f8469d9596c3fd6ff7ac20ecc0e2d1d4831bfd20288a7be0a1ffe63bada3
- SHA512
  
  4ea1087d2fcfb9130ab6370dc3dc039b9b7b8080e723f63ced71501fce3ef4f472ac3fa3d041d6bc053daf86c07f0a6ac2b9bddc6fa002fd1e2e8b7868b1fec5
- SSDEEP
  
  3072:R/4tNF9U4vvlKw6J73x8UmkiSFxfKxbXe:BUNFK+l8T8UmkiSFxfKxbXe
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1