gafgyt | f01dd98cb5003b692b097c3e9e2493ddd041511d4e1b2874d85fb6e1bbfd3a9b | Triage

Sharing

General

Target

fb339cf69c95dc0cfc2e39212b653781.elf
Size

113KB
Sample

230321-gwgptaha43
MD5

fb339cf69c95dc0cfc2e39212b653781
SHA1

c3dfc45c904bf581cdc2cd4bb4ae3cd04ae5072c
SHA256

f01dd98cb5003b692b097c3e9e2493ddd041511d4e1b2874d85fb6e1bbfd3a9b
SHA512

2ee376b32955973fb2212c05cc6ae20b18a2a2ca1f3b3fd1f1956aa25ec9427c9e494a642b177b9bf9030466ae390a06e228b24921c7a848f212028ce451db55
SSDEEP

3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1Ae:O9anO5hZLHKdwwjF9GhsR1Ae

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  fb339cf69c95dc0cfc2e39212b653781.elf
- Size
  
  113KB
- MD5
  
  fb339cf69c95dc0cfc2e39212b653781
- SHA1
  
  c3dfc45c904bf581cdc2cd4bb4ae3cd04ae5072c
- SHA256
  
  f01dd98cb5003b692b097c3e9e2493ddd041511d4e1b2874d85fb6e1bbfd3a9b
- SHA512
  
  2ee376b32955973fb2212c05cc6ae20b18a2a2ca1f3b3fd1f1956aa25ec9427c9e494a642b177b9bf9030466ae390a06e228b24921c7a848f212028ce451db55
- SSDEEP
  
  3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1Ae:O9anO5hZLHKdwwjF9GhsR1Ae
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1