gafgyt | 8e09e51d5208da2e2340a6ebed8328757cd096a29d6b7e0ee7d6189c3dd08cf3 | Triage

Sharing

General

Target

eda23694623e5fa04176d171e8a6c616.elf
Size

110KB
Sample

230323-xm2xdshe94
MD5

eda23694623e5fa04176d171e8a6c616
SHA1

dff56d6f0edd73eeda77a67199c4d317e4d0cf94
SHA256

8e09e51d5208da2e2340a6ebed8328757cd096a29d6b7e0ee7d6189c3dd08cf3
SHA512

d0d9b49e06e9d31c99d773a864e5d9b297a8409b40f8dbc8a21e13221ec53a1c75be4b470b7e1e3ac59ecbd5db64713eb7bcdd0696552aa76de778712e1e6cd6
SSDEEP

3072:R/4tNF9U4vvfKw6J73x8UmkiSFxfKxbXe:BUNFK+f8T8UmkiSFxfKxbXe

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  eda23694623e5fa04176d171e8a6c616.elf
- Size
  
  110KB
- MD5
  
  eda23694623e5fa04176d171e8a6c616
- SHA1
  
  dff56d6f0edd73eeda77a67199c4d317e4d0cf94
- SHA256
  
  8e09e51d5208da2e2340a6ebed8328757cd096a29d6b7e0ee7d6189c3dd08cf3
- SHA512
  
  d0d9b49e06e9d31c99d773a864e5d9b297a8409b40f8dbc8a21e13221ec53a1c75be4b470b7e1e3ac59ecbd5db64713eb7bcdd0696552aa76de778712e1e6cd6
- SSDEEP
  
  3072:R/4tNF9U4vvfKw6J73x8UmkiSFxfKxbXe:BUNFK+f8T8UmkiSFxfKxbXe
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1