gafgyt | a8615d2c052280ffd105a5c9872fa663e4cb4e7b88e6bea0924a96f3261942c1 | Triage

Sharing

General

Target

708e9dc944fa9e36b62881d6ac08c8aa.bin
Size

64KB
Sample

230328-b3xrqagc86
MD5

8d9338487f4cb1526969f00c3090fea2
SHA1

7c43a7934fbe2bc966a01c815efef385cd5e841d
SHA256

a8615d2c052280ffd105a5c9872fa663e4cb4e7b88e6bea0924a96f3261942c1
SHA512

7f2d3a7938b5719f7066cd42a77f78f74da996e2ee249d4d60e05e7cce5b4c80bb111a417b73d033003813149a59df5f1f3e1f9a93b09c1d498acffe2e2af0f5
SSDEEP

1536:manSLFFb3W8O3FlzYOp/kCKNq4BM4mKUBiziufkXaKq9zaU8rKOSgx:eFJ3tODzJ/kJTB992ZXaK4zaUlOPx

Score

10^/10

gafgyt persistence

Malware Config

Targets

- Target
  
  673203aa86c58b8c5d2af610ba59e61800e390eeea0e8e6c02157b8f219a40ca.elf
- Size
  
  160KB
- MD5
  
  708e9dc944fa9e36b62881d6ac08c8aa
- SHA1
  
  989889488d7643a777e613223b0e7f78150c8d21
- SHA256
  
  673203aa86c58b8c5d2af610ba59e61800e390eeea0e8e6c02157b8f219a40ca
- SHA512
  
  dee5f3b5b11262d884ba78bd125278a8b493c8473fdf37ea479a1aedc69560df28ebc853702eb7e8de81a0bf7bb0617486337e307836a8090eb03421f80eebb7
- SSDEEP
  
  3072:pQrBzuvjgC/m/uND3wGiTagGFBhGzH/6fdetJ8add9QzhsxNjeus5EymyOQ0LOXP:pTwG8a1FaL6fdetJ8addQ0NjeiymyOQP
Score

7^/10

persistence
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1