gafgyt | ded4ae6ccec0ab7646c20325ebbb82f56d2109ed63cc8af678ba33eb7dcff16e | Triage

Sharing

General

Target

61b7c6951e301fcbd859bb66e862e0e8.elf
Size

105KB
Sample

230329-qndsmagd98
MD5

61b7c6951e301fcbd859bb66e862e0e8
SHA1

c48b67bf04600476de77446d1387b255113e9a4e
SHA256

ded4ae6ccec0ab7646c20325ebbb82f56d2109ed63cc8af678ba33eb7dcff16e
SHA512

1fe7ba4fe7a43a28fdccdd031b729ea8606a7a218930affc5ee1c10b2917600cc6525f5771675a7f51ca96ee816b4c1b8dcd1535edc041a5d21c75ee03c5d76e
SSDEEP

3072:OaKh4ut9WuRg0WpGDa5SMXzfbmNQfPfXv4n:OaKh4uFWpGDobmNQfP/v4n

Score

10^/10

gafgyt

Malware Config

Targets

- Target
  
  61b7c6951e301fcbd859bb66e862e0e8.elf
- Size
  
  105KB
- MD5
  
  61b7c6951e301fcbd859bb66e862e0e8
- SHA1
  
  c48b67bf04600476de77446d1387b255113e9a4e
- SHA256
  
  ded4ae6ccec0ab7646c20325ebbb82f56d2109ed63cc8af678ba33eb7dcff16e
- SHA512
  
  1fe7ba4fe7a43a28fdccdd031b729ea8606a7a218930affc5ee1c10b2917600cc6525f5771675a7f51ca96ee816b4c1b8dcd1535edc041a5d21c75ee03c5d76e
- SSDEEP
  
  3072:OaKh4ut9WuRg0WpGDa5SMXzfbmNQfPfXv4n:OaKh4uFWpGDobmNQfP/v4n
Score

7^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration
  Uses contents of /proc filesystem to enumerate network settings.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1