gafgyt | d837d2a8c7b5c6f5d291ad11b608656a894b4099cb4f4f5beca62342fe078903 | Triage

Sharing

General

Target

0203f2f2c90badad38e2062c528c59b2.elf
Size

152KB
Sample

230319-m1ptwaga68
MD5

0203f2f2c90badad38e2062c528c59b2
SHA1

4577ffd60b163a4ad1abb3e3bb5da125491476f4
SHA256

d837d2a8c7b5c6f5d291ad11b608656a894b4099cb4f4f5beca62342fe078903
SHA512

98711fe396173bcc402ae75d17db199d6dd99fb838618504429c4827741d4a55824571fcba2ae941f71c18e9595fb2d360e7b4e20f902ac52a1186c9bc4273c3
SSDEEP

3072:adHtg2Nav5HqvGgBMKmh9H5S5hTKGRvEM/9RuDK37m5wTsL/Qpyn:KNZNav5HquA09HE5hTKGRcM/9Ei7m5wS

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  0203f2f2c90badad38e2062c528c59b2.elf
- Size
  
  152KB
- MD5
  
  0203f2f2c90badad38e2062c528c59b2
- SHA1
  
  4577ffd60b163a4ad1abb3e3bb5da125491476f4
- SHA256
  
  d837d2a8c7b5c6f5d291ad11b608656a894b4099cb4f4f5beca62342fe078903
- SHA512
  
  98711fe396173bcc402ae75d17db199d6dd99fb838618504429c4827741d4a55824571fcba2ae941f71c18e9595fb2d360e7b4e20f902ac52a1186c9bc4273c3
- SSDEEP
  
  3072:adHtg2Nav5HqvGgBMKmh9H5S5hTKGRvEM/9RuDK37m5wTsL/Qpyn:KNZNav5HquA09HE5hTKGRcM/9Ei7m5wS
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1