gafgyt | 1b9302eea9733138ff0448c122d1be1583fa0229e902a2ea8ee0cee52be0d852 | Triage

Sharing

General

Target

93fd2ad8cafe4e0ef58d2932ea1bd85c.elf
Size

170KB
Sample

230326-q6dwcaaf7t
MD5

93fd2ad8cafe4e0ef58d2932ea1bd85c
SHA1

1f30e78844e28dd746cc4cfc26a44bd48eef05f6
SHA256

1b9302eea9733138ff0448c122d1be1583fa0229e902a2ea8ee0cee52be0d852
SHA512

4cf00d0ba875ef63b656f7606b0f439c31445a1216f76424f2ee78404a575636eac3ed7c3194d9fe1c21c2edd57a0e39feda934e15ca7f3395eb551c066c3f73
SSDEEP

3072:C0umqfmbFKXBCetJ8add9Qzhs1RIKPHsqdfi+KqLwZi+LUk:C0umqkFuwetJ8addQcRIGTdfi+KqLwUO

Score

10^/10

gafgyt persistence

Malware Config

Targets

- Target
  
  93fd2ad8cafe4e0ef58d2932ea1bd85c.elf
- Size
  
  170KB
- MD5
  
  93fd2ad8cafe4e0ef58d2932ea1bd85c
- SHA1
  
  1f30e78844e28dd746cc4cfc26a44bd48eef05f6
- SHA256
  
  1b9302eea9733138ff0448c122d1be1583fa0229e902a2ea8ee0cee52be0d852
- SHA512
  
  4cf00d0ba875ef63b656f7606b0f439c31445a1216f76424f2ee78404a575636eac3ed7c3194d9fe1c21c2edd57a0e39feda934e15ca7f3395eb551c066c3f73
- SSDEEP
  
  3072:C0umqfmbFKXBCetJ8add9Qzhs1RIKPHsqdfi+KqLwZi+LUk:C0umqkFuwetJ8addQcRIGTdfi+KqLwUO
Score

7^/10

persistence
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1