gafgyt | 0b862a3b57ce17fe2780541d0bde2b77965eba3065bd40fb9fb7df884e525336 | Triage

Sharing

General

Target

e9be7ee316f1e48e32c424b15c7f669f.elf
Size

110KB
Sample

230320-kw7g1sef8z
MD5

e9be7ee316f1e48e32c424b15c7f669f
SHA1

c824af7a0fcaced52006c1449356a1520c66431a
SHA256

0b862a3b57ce17fe2780541d0bde2b77965eba3065bd40fb9fb7df884e525336
SHA512

a079ec3ca17ba22357b07553edcfe73f12eb9cfdcaa25e3c5d55f0302e86149553bea55a7b9e26f062165452da39f881dd28c267be139abfb6a70a0b8da1434a
SSDEEP

3072:R/4tNF9U4vvZKw6J73x8UmkiSFxfKxbXe:BUNFK+Z8T8UmkiSFxfKxbXe

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  e9be7ee316f1e48e32c424b15c7f669f.elf
- Size
  
  110KB
- MD5
  
  e9be7ee316f1e48e32c424b15c7f669f
- SHA1
  
  c824af7a0fcaced52006c1449356a1520c66431a
- SHA256
  
  0b862a3b57ce17fe2780541d0bde2b77965eba3065bd40fb9fb7df884e525336
- SHA512
  
  a079ec3ca17ba22357b07553edcfe73f12eb9cfdcaa25e3c5d55f0302e86149553bea55a7b9e26f062165452da39f881dd28c267be139abfb6a70a0b8da1434a
- SSDEEP
  
  3072:R/4tNF9U4vvZKw6J73x8UmkiSFxfKxbXe:BUNFK+Z8T8UmkiSFxfKxbXe
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1