gafgyt | c12bc6a7b13591a732b61146d00bc1cb483d7ae95df007cddc0112ab835339d7 | Triage

Sharing

General

Target

82415e8838d0e36c3e60d300dc1f9fd3.elf
Size

100KB
Sample

230322-g26wwsfb87
MD5

82415e8838d0e36c3e60d300dc1f9fd3
SHA1

8aabdf5e7d068d40797af6698ad293014010bc07
SHA256

c12bc6a7b13591a732b61146d00bc1cb483d7ae95df007cddc0112ab835339d7
SHA512

0a137711077d549464c5968978c1e7a941e09fae86c4a909a1f81e30397d6b773f7abc03a2841a9a60784a6962a9d5efe6a8b2357caf05a7b307e5a98862e896
SSDEEP

3072:QBpHuN9/36Z+pjtwiCphagC1yg9luJ2hgYZiSb:EpHs/3hgphagC1yg9luJ2hgYZiSb

Score

10^/10

gafgyt linux

Malware Config

Targets

- Target
  
  82415e8838d0e36c3e60d300dc1f9fd3.elf
- Size
  
  100KB
- MD5
  
  82415e8838d0e36c3e60d300dc1f9fd3
- SHA1
  
  8aabdf5e7d068d40797af6698ad293014010bc07
- SHA256
  
  c12bc6a7b13591a732b61146d00bc1cb483d7ae95df007cddc0112ab835339d7
- SHA512
  
  0a137711077d549464c5968978c1e7a941e09fae86c4a909a1f81e30397d6b773f7abc03a2841a9a60784a6962a9d5efe6a8b2357caf05a7b307e5a98862e896
- SSDEEP
  
  3072:QBpHuN9/36Z+pjtwiCphagC1yg9luJ2hgYZiSb:EpHs/3hgphagC1yg9luJ2hgYZiSb
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1