General

  • Target

    07e40500a3644190cfc1a6a4579af30d

  • Size

    135KB

  • Sample

    231219-2cbdxaffen

  • MD5

    07e40500a3644190cfc1a6a4579af30d

  • SHA1

    636cdc721e00da4668fd1228431f9afe6eab69dc

  • SHA256

    552ca1811b37d5021e5359c886a8d7b2d637663e5152c5a688db89f3ea0a7383

  • SHA512

    73fa724cc7cfa62e7244ab9217bccc90750116ae63f679b853e2998b8b5f765b7cef54927543e38fd8997d5cd44ea19280e342bf5d496a29c9f030e37abf7e0a

  • SSDEEP

    3072:yGQxoHQIuTBhmSJmUAaHhHtn0rlHplgVP5hjH2Y2QotzgmyhQaS+pg7J:yHmUAaHhHFVP5hjH27gmyhQaSGg7J

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

89.34.237.191:282

Targets

    • Target

      07e40500a3644190cfc1a6a4579af30d

    • Size

      135KB

    • MD5

      07e40500a3644190cfc1a6a4579af30d

    • SHA1

      636cdc721e00da4668fd1228431f9afe6eab69dc

    • SHA256

      552ca1811b37d5021e5359c886a8d7b2d637663e5152c5a688db89f3ea0a7383

    • SHA512

      73fa724cc7cfa62e7244ab9217bccc90750116ae63f679b853e2998b8b5f765b7cef54927543e38fd8997d5cd44ea19280e342bf5d496a29c9f030e37abf7e0a

    • SSDEEP

      3072:yGQxoHQIuTBhmSJmUAaHhHtn0rlHplgVP5hjH2Y2QotzgmyhQaS+pg7J:yHmUAaHhHFVP5hjH27gmyhQaSGg7J

    Score
    7/10
    • Changes its process name

    • Deletes itself

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks